use environment variables exclusively for sensitive info