ignoring .env
signature & data validation