returning secrets doesn't seem right, even if it is just a PoC