use APP_CONFIG for any sensitive information