secrets moved to config folder