diff --git a/arvo/eyre.hoon b/arvo/eyre.hoon
index 4e3a87165..0d902dc48 100644
--- a/arvo/eyre.hoon
+++ b/arvo/eyre.hoon
@@ -1633,6 +1633,11 @@
           +12.q
         =+  ato=(sky [151 %noun] %cx (tope root-beak [%atom (flop %_(dom . sec+dom))]))
         =+  key=?~(ato '' ;;(@t u.ato))  ::  XX jael
+        =.  key
+          ?~  key  ''
+          %-  (bond |.(~&(bad-key+[dom key] '')))
+          =+  (slaw %uw key)
+          ?~(- ~ (de:crua load-secret u))  :: XX clay permissions
         `(bale)`[[our now (shas %bale eny) root-beak] [usr dom] key]
       ==
     ::
diff --git a/lib/write.hoon b/lib/write.hoon
index f73e6cae9..6099d09de 100644
--- a/lib/write.hoon
+++ b/lib/write.hoon
@@ -51,10 +51,16 @@
     ==
   (poke--data [`%md pax] %mime / (taco txt))
 ::
+++  ames-secret
+  ^-  @t
+  =-  (crip +:<.^(@p %a pax)>)
+  pax=/(scot %p our)/code/(scot %da now)/(scot %p our)
+::
 ++  poke-sec-atom
   |=  {hot/host dat/@}
   ?>  ?=($& -.hot)
   =.  p.hot  (scag 2 p.hot)      :: ignore subdomain
+  =.  dat  (scot %uw (en:crua ames-secret dat))  ::  XX clay permissions
   (poke--data [`%atom [%sec p.hot]] %mime / (taco dat))
 ::
 ++  poke--data
diff --git a/sec/com/github.atom b/sec/com/github.atom
index 262e91169..dc140b9b9 100644
--- a/sec/com/github.atom
+++ b/sec/com/github.atom
@@ -1 +1 @@
-cGhpbGlwY21vbmt0ZXN0OjEzMzdwYXNzd29yZA==
\ No newline at end of file
+0wy-6.mDQa9.1XfY5.XF0tQ.28rEc.A6A40.T7YoZ.NdPMT.WifG3.82OJT.FrjnC.gLrsz.wO2sX.0Xi7h.Xv8cg.KFTTy.dFYMr.QMIsq.Y~ydB.zJIuK.NIGqU.ftlaD.-QpVd.zTWuY.XgeS~.qndM4
\ No newline at end of file