use dotenv to hide credentials