move secure env vars to global