secrets: script configs take no pointer; refusals and doors share one rule