move credentials to sec.json