diff --git a/packages/cli/package.json b/packages/cli/package.json
index 83ff704..aa9a7e9 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -29,6 +29,7 @@
     "@rollup/plugin-sucrase": "^5.0.2",
     "@trpc/client": "^10.45.0",
     "commander": "^11.1.0",
+    "dotenv": "^16.3.1",
     "env-paths": "^3.0.0",
     "inquirer": "^9.2.12",
     "ora": "^8.0.1",
diff --git a/packages/cli/src/commands/local/local.run.ts b/packages/cli/src/commands/local/local.run.ts
index 2759362..872e408 100644
--- a/packages/cli/src/commands/local/local.run.ts
+++ b/packages/cli/src/commands/local/local.run.ts
@@ -3,6 +3,7 @@ import { resolve } from 'path';
 import { run as runLoad } from '@morten-olsen/mini-loader-runner';
 import { bundle } from '../../bundler/bundler.js';
 import { step } from '../../utils/step.js';
+import { readSecrets } from './local.utils.js';
 
 const run = new Command('run');
 
@@ -12,12 +13,14 @@ run
   .action(async (script) => {
     const location = resolve(script);
     const { autoInstall } = run.opts();
+    const secrets = await readSecrets();
 
     const code = await step('Bundling', async () => {
       return await bundle({ entry: location, autoInstall });
     });
     const { promise, emitter } = await runLoad({
       script: code,
+      secrets,
     });
     emitter.addListener('message', (message) => {
       switch (message.type) {
diff --git a/packages/cli/src/commands/local/local.utils.ts b/packages/cli/src/commands/local/local.utils.ts
new file mode 100644
index 0000000..8a8da08
--- /dev/null
+++ b/packages/cli/src/commands/local/local.utils.ts
@@ -0,0 +1,25 @@
+import dotenv from 'dotenv';
+import { existsSync } from 'fs';
+import { readFile } from 'fs/promises';
+import { join } from 'path';
+
+const ENV_PREFIX = 'ML_S_';
+
+const readSecrets = async () => {
+  let secretLocation = join(process.cwd(), '.secret');
+
+  let secrets: Record<string, string> = {};
+
+  if (existsSync(secretLocation)) {
+    const content = await readFile(secretLocation, 'utf-8');
+    secrets = dotenv.parse(content);
+  }
+  for (const key in process.env) {
+    if (key.startsWith(ENV_PREFIX)) {
+      secrets[key.replace(ENV_PREFIX, '')] = process.env[key]!;
+    }
+  }
+  return secrets;
+};
+
+export { readSecrets };
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1294296..893d72d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -63,6 +63,9 @@ importers:
       commander:
         specifier: ^11.1.0
         version: 11.1.0
+      dotenv:
+        specifier: ^16.3.1
+        version: 16.3.1
       env-paths:
         specifier: ^3.0.0
         version: 3.0.0
@@ -2189,6 +2192,11 @@ packages:
       esutils: 2.0.3
     dev: true
 
+  /dotenv@16.3.1:
+    resolution: {integrity: sha512-IPzF4w4/Rd94bA9imS68tZBaYyBWSCE47V1RGuMrB94iyTOIEwRmVL2x/4An+6mETpLrKJ5hQkB8W4kFAadeIQ==}
+    engines: {node: '>=12'}
+    dev: false
+
   /eastasianwidth@0.2.0:
     resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==}
     dev: false