deal with secrets on server