move sensitive info to /config/application.yaml
update todo list