use env var for production secrets