new secrets.yml convention