use secrets capability only for secrets