How to set environment variables and insert into a custom action?

Hey,

I have a few custom actions set up in my app however I've had to hardcode keys, not ideal when I go to production.

Are app state variables securely saved? Is there a way to create environment variables etc?

My app is a web app so people could peek the code hence I need more security.