remove hardcoded passphrase