Ah I see, when running in local mode I need to setup my own secrets provider. In prod I use pulumi cloud, so will just use something quick & nasty for local env