fix security by moving to env vars and using a new wallet