diff --git a/scripts/new-app.sh b/scripts/new-app.sh
index b9113a6..64ee3af 100755
--- a/scripts/new-app.sh
+++ b/scripts/new-app.sh
@@ -5,6 +5,16 @@ GITEA_URL="https://git.timothykim.net"
 GITEA_ORG="hantim"
 TEMPLATE_REPO="static-site-template"
 SPINNER='⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏'
+spin_wait() {
+    local secs=$1 msg=$2 start=$3 i=0
+    while [ $i -lt $((secs * 4)) ]; do
+        local elapsed=$(( start + i / 4 ))
+        local sc=${SPINNER:$(( (i) % ${#SPINNER} )):1}
+        printf "\r  %s %s (%ds)" "$sc" "$msg" "$elapsed"
+        sleep 0.25
+        i=$((i + 1))
+    done
+}
 
 if [ -z "${1:-}" ]; then
     echo "Usage: ./scripts/new-app.sh <domain>"
@@ -55,10 +65,14 @@ if ! command -v dig &>/dev/null; then
     exit 1
 fi
 
-# --- Get secrets (cached in env vars, or fetch from Bitwarden) ---
+# --- Get secrets (cached in file, or fetch from Bitwarden) ---
 
-if [ -n "${HANTIM_GITEA_TOKEN:-}" ] && [ -n "${HANTIM_VULTR_API_KEY:-}" ] && [ -n "${HANTIM_DEPLOY_KEY:-}" ]; then
-    echo "Using cached secrets from environment."
+SECRETS_CACHE="${XDG_CACHE_HOME:-$HOME/.cache}/hantim-secrets"
+
+if [ -f "$SECRETS_CACHE" ]; then
+    echo "Using cached secrets."
+    # shellcheck source=/dev/null
+    source "$SECRETS_CACHE"
     GITEA_TOKEN="$HANTIM_GITEA_TOKEN"
     VULTR_API_KEY="$HANTIM_VULTR_API_KEY"
     DEPLOY_KEY="$HANTIM_DEPLOY_KEY"
@@ -78,9 +92,13 @@ else
     VULTR_API_KEY=$(bw get notes hantim-vultr-api-key --session "${BW_SESSION:-}")
     DEPLOY_KEY=$(bw get item hantim-server-deploy --session "${BW_SESSION:-}" | jq -r '.sshKey.privateKey')
 
-    export HANTIM_GITEA_TOKEN="$GITEA_TOKEN"
-    export HANTIM_VULTR_API_KEY="$VULTR_API_KEY"
-    export HANTIM_DEPLOY_KEY="$DEPLOY_KEY"
+    mkdir -p "$(dirname "$SECRETS_CACHE")"
+    cat > "$SECRETS_CACHE" <<CACHE
+HANTIM_GITEA_TOKEN='$(echo "$GITEA_TOKEN" | sed "s/'/'\\\\''/g")'
+HANTIM_VULTR_API_KEY='$(echo "$VULTR_API_KEY" | sed "s/'/'\\\\''/g")'
+HANTIM_DEPLOY_KEY='$(echo "$DEPLOY_KEY" | sed "s/'/'\\\\''/g")'
+CACHE
+    chmod 600 "$SECRETS_CACHE"
 fi
 
 DEPLOY_KEY_FILE=$(mktemp)
@@ -153,9 +171,7 @@ for i in $(seq 1 30); do
         echo "  If this is a new domain, make sure nameservers are set to Vultr on directnic.com."
         exit 1
     fi
-    SC=${SPINNER:$(( (i - 1) % ${#SPINNER} )):1}
-    printf "\r  %s Waiting for DNS... (%ds)" "$SC" "$ELAPSED"
-    sleep 10
+    spin_wait 10 "Waiting for DNS..." "$ELAPSED"
     ELAPSED=$((ELAPSED + 10))
 done
 
@@ -302,9 +318,7 @@ for i in $(seq 1 60); do
         -H "Content-Type: application/json" \
         -d '{"ref": "main"}')
     [ "$TRIGGER_CODE" != "404" ] && printf "\r\033[K" && break
-    SC=${SPINNER:$(( (i - 1) % ${#SPINNER} )):1}
-    printf "\r  %s Waiting for repo to be ready... (%ds)" "$SC" "$ELAPSED"
-    sleep 2
+    spin_wait 2 "Waiting for repo to be ready..." "$ELAPSED"
     ELAPSED=$((ELAPSED + 2))
 done
 
@@ -324,9 +338,7 @@ for i in $(seq 1 18); do
         printf "\r\033[K  Site is live at https://www.$APP\n"
         exit 0
     fi
-    SC=${SPINNER:$(( (i - 1) % ${#SPINNER} )):1}
-    printf "\r  %s Waiting for site... (%ds)" "$SC" "$ELAPSED"
-    sleep 10
+    spin_wait 10 "Waiting for site..." "$ELAPSED"
     ELAPSED=$((ELAPSED + 10))
 done
 printf "\r\033[K"
diff --git a/scripts/remove-app.sh b/scripts/remove-app.sh
index 2187a44..de9d43e 100755
--- a/scripts/remove-app.sh
+++ b/scripts/remove-app.sh
@@ -28,10 +28,14 @@ if ! command -v bw &>/dev/null; then
     exit 1
 fi
 
-# --- Get secrets (cached in env vars, or fetch from Bitwarden) ---
+# --- Get secrets (cached in file, or fetch from Bitwarden) ---
 
-if [ -n "${HANTIM_GITEA_TOKEN:-}" ]; then
-    echo "Using cached secrets from environment."
+SECRETS_CACHE="${XDG_CACHE_HOME:-$HOME/.cache}/hantim-secrets"
+
+if [ -f "$SECRETS_CACHE" ]; then
+    echo "Using cached secrets."
+    # shellcheck source=/dev/null
+    source "$SECRETS_CACHE"
     GITEA_TOKEN="$HANTIM_GITEA_TOKEN"
 else
     if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
@@ -46,8 +50,6 @@ else
 
     bw sync --session "${BW_SESSION:-}"
     GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
-
-    export HANTIM_GITEA_TOKEN="$GITEA_TOKEN"
 fi
 
 # --- Delete Gitea repo ---