moves secrets to env variables