replace env with secrets