Why is this secret key not in an environment variable?