correctly use secure environment variable

... I think