hid app secrets (whoops)