use direnv instead (for security and flexibility)