externalize sensitive variables