remove secret is under vars, not global