changed to store secrets in separate config