put sanitized secrets.yml back in
document toolchain