K6 Cloud Secret Support

What is the correct way to handle secrets with k6 cloud? I can use --secret-source=file locally with k6 run but this same command run with k6 cloud run doesn’t seem to handle the secrets. I end up with the following error:

ERRO[0024] Uncaught (in promise) no secret sources are configured

Alternatively, using k6 cloud env variables doesn’t seem to provide any masking support for secrets.

Any help would be appreciated.