add secrets.yml (is this the death of me?)