`secret` is assigned in the async callback, so it seems that it wouldn't be initialised here.