[tooling] defaults for secrets