Meteor secret server code -- reference error, variable not defined -

in section of secret server code in meteor docs (https://guide.meteor.com/security.html#secret-code) seem use global variable defined on server, thus, code can seen , reached on server. seems simple enough.

but when do

upload = { test: "my secret code" } 

inside folder server/upload.js error

w20170726-10:04:59.843(2)? (stderr)  c:\users\myuser\appdata\local\.meteor\packages\meteor-tool\1.5.0\mt-os.windows.x86_32\dev_bundle\server-lib\node_modules\fibers\future.js:280 w20170726-10:04:59.844(2)? (stderr)                                             throw(ex); w20170726-10:04:59.846(2)? (stderr)                                             ^ w20170726-10:04:59.847(2)? (stderr) w20170726-10:04:59.847(2)? (stderr) referenceerror: upload not defined w20170726-10:04:59.848(2)? (stderr)     @ meteorinstall.server.upload.upload.js (server/upload/upload.js:1:1) w20170726-10:04:59.849(2)? (stderr)     @ fileevaluate (packages\modules-runtime.js:333:9) w20170726-10:04:59.850(2)? (stderr)     @ require (packages\modules-runtime.js:228:16) w20170726-10:04:59.851(2)? (stderr)     @ c:\users\myuser\documents\projects\myproject\.meteor\local\build\programs\server\app\app.js:10417:1 w20170726-10:04:59.852(2)? (stderr)     @ c:\users\myuser\documents\projects\myproject\.meteor\local\build\programs\server\boot.js:338:34 w20170726-10:04:59.853(2)? (stderr)     @ array.foreach (native) w20170726-10:04:59.854(2)? (stderr)     @ function._.each._.foreach (c:\users\myuser\appdata\local\.meteor\packages\meteor-tool\1.5.0\mt-os.windows.x86_32\dev_bundle\server-lib\node_modules\underscore\underscore.js:79:11) w20170726-10:04:59.855(2)? (stderr)     @ c:\users\myuser\documents\projects\myproject\.meteor\local\build\programs\server\boot.js:158:5 w20170726-10:04:59.856(2)? (stderr)     @ c:\users\myuser\documents\projects\myproject\.meteor\local\build\programs\server\boot.js:387:5 w20170726-10:04:59.858(2)? (stderr)     @ function.run (c:\users\myuser\documents\projects\myproject\.meteor\local\build\programs\server\profile.js:510:12) 

are docs wrong or doing weird? i'm using meteor version 1.5.0, happens on both windows , linux.

the documentation states, that

secret business logic in app should located in code loaded on server

it (unfortunately just) implies, code meteor methods or validated methods virtually executed on client (see this.issimulation) part of optimistic ui , may expose secrets, such keys.

using global.myvariable = { ... } not solution here.

to make more clear you, extend example docs little bit:

/server/mmr.js (only loaded server)

export const mmr = {   updatewithsecretalgorithm(userid) {     // secret code here   } } 

/both/updatemmr.js (loaded both server , client)

if (meteor.isserver) {     //eslint nag not cause error     import {mmr} '../server/mmr.js'; }  // in file loaded on client , server const meteor.users.methods.updatemmr = new validatedmethod({   name: 'meteor.users.methods.updatemmr',   validate: null,   run() {     if (this.issimulation) {       // simulation code client (optional)     } else {       mmr.updatewithsecretalgorithm(this.userid);     }   } }); 

the meteor.isserver assures, there no attempt of client import mmr, cause error on startup. long load mmr.js file on server there no mmr object exposed client.

i hope makes example bit more clear.