make secrets readable only from the environment