we track secrets.yml now and use ENV vars