diff --git a/.gitignore b/.gitignore
index c9331bf..1868cf2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,9 +1,8 @@
-_site/
+_site
 node_modules
 .cache
 patches
-tools/in/*
-!tools/in/.gitkeep
-tools/out/*
-!tools/out/.gitkeep
+tools/in
+tools/out
 tina
+.env
diff --git a/package-lock.json b/package-lock.json
index 5129898..6be1d36 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,6 +13,7 @@
 				"@11ty/eleventy-plugin-rss": "^2.0.2",
 				"@11ty/eleventy-plugin-syntaxhighlight": "^5.0.0",
 				"cross-env": "^7.0.3",
+				"dotenv": "^16.4.7",
 				"jsdom": "^25.0.1",
 				"luxon": "^3.3.0",
 				"markdown-it-anchor": "^8.6.7",
@@ -1389,6 +1390,17 @@
 				"url": "https://github.com/fb55/domutils?sponsor=1"
 			}
 		},
+		"node_modules/dotenv": {
+			"version": "16.4.7",
+			"resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.4.7.tgz",
+			"integrity": "sha512-47qPchRCykZC03FhkYAhrvwU4xDBFIj1QPqaarj6mdM/hgUzfPHcpkHJOn3mJAufFeeAxAzeGsr5X0M4k6fLZQ==",
+			"engines": {
+				"node": ">=12"
+			},
+			"funding": {
+				"url": "https://dotenvx.com"
+			}
+		},
 		"node_modules/dunder-proto": {
 			"version": "1.0.0",
 			"resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.0.tgz",
diff --git a/package.json b/package.json
index acff80b..b2c1a94 100644
--- a/package.json
+++ b/package.json
@@ -38,6 +38,7 @@
 		"@11ty/eleventy-plugin-rss": "^2.0.2",
 		"@11ty/eleventy-plugin-syntaxhighlight": "^5.0.0",
 		"cross-env": "^7.0.3",
+		"dotenv": "^16.4.7",
 		"jsdom": "^25.0.1",
 		"luxon": "^3.3.0",
 		"markdown-it-anchor": "^8.6.7",
diff --git a/tools/img-shrink.js b/tools/img-shrink.js
index a36c10e..b41b3b0 100644
--- a/tools/img-shrink.js
+++ b/tools/img-shrink.js
@@ -7,7 +7,18 @@ const dirOut = 'tools/out';
 const thresholdBytes = 2 * 1024 * 1024;
 const quality = [100, 99, 97, 95, 90, 80, 75, 70, 60, 50, 40];
 
+async function makedir(dir) {
+    try {
+        await fs.stat(dir);
+    } catch (err) {
+        if (err.code !== 'ENOENT') throw err;
+        await fs.mkdir(dir);
+    }
+}
+
 async function main() {
+    await makedir(dirIn);
+    await makedir(dirOut);
     for (const base of await fs.readdir(dirIn)) {
         if (base === '.gitkeep') continue;
         const fileIn = `${dirIn}/${base}`;
diff --git a/tools/in/.gitkeep b/tools/in/.gitkeep
deleted file mode 100644
index e69de29..0000000
diff --git a/tools/list-files.js b/tools/list-files.js
new file mode 100644
index 0000000..a960240
--- /dev/null
+++ b/tools/list-files.js
@@ -0,0 +1,16 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+async function main() {
+  let count = 0;
+  for (const file of await fs.readdir('_site', { recursive: true })) {
+    const absolute = path.join('_site', file);
+    const stat = await fs.stat(absolute);
+    if (stat.isDirectory()) continue;
+    console.log(file);
+    count += 1;
+  }
+  console.log(`total: ${count}`);
+}
+
+main();
diff --git a/tools/out/.gitkeep b/tools/out/.gitkeep
deleted file mode 100644
index e69de29..0000000
diff --git a/tools/secrets.js b/tools/secrets.js
new file mode 100644
index 0000000..33650a0
--- /dev/null
+++ b/tools/secrets.js
@@ -0,0 +1,9 @@
+import dotenv from 'dotenv';
+
+dotenv.config();
+
+function main() {
+    console.log(`SECRET=${process.env.SECRET}`);
+}
+
+main();