update secrets.yml -- wont do this in a real app