move embed-secret into script/