hardcoded master secret (=secret)