hardcoded secret