add notes about generating secure env [ci-skip]