correctly read secrets from env var