remove hardcoded secrets