Fix: don't hardcode key password