feature: read sensitive conf from env