updated to use env.sh to hide secrets