metadata only · secrets stay on the machine