or, don't put secrets in .env files...