One secure per env variable
fix bash substitutions for credentials