Don’t hardcode secret tokens.