diff --git a/lib/commands/run.js b/lib/commands/run.js
index 909f947..371d932 100644
--- a/lib/commands/run.js
+++ b/lib/commands/run.js
@@ -6,7 +6,10 @@ var Future = require('fibers/future');
 
 var syncSource = function (filepath) {
   var future = new Future;
-  source(filepath, future.resolver());
+  var rootpath = path.parse(filepath).root;
+  var projectpath = filepath.split(path.sep).slice(0,-3).join(path.sep);
+  var handlerpath = path.join(rootpath, projectpath, 'bin', 'env_handler.sh');
+  source(filepath, {'wrapper': handlerpath}, future.resolver());
   return future.wait();
 };
 
diff --git a/lib/templates/project/bin/env_handler.sh b/lib/templates/project/bin/env_handler.sh
new file mode 100755
index 0000000..4034121
--- /dev/null
+++ b/lib/templates/project/bin/env_handler.sh
@@ -0,0 +1,24 @@
+#######################################################################
+# Use this script to do any pre-processing to your env.sh scripts     #
+#######################################################################
+# Example below is decrypting your env.sh file before sourcing,       #
+# useful when you want to keep credentials out of the git repo.       #
+# Not useful for hiding credentials on server or developer machines.  #
+#######################################################################
+#
+# gpg2 --batch --quiet --no-verbose -d "$1" > /tmp/env.sh
+# . /tmp/env.sh
+# # Linux
+# shred /tmp/env.sh
+# # OSX
+# srm /tmp/env.sh
+
+# You only want to have one "source" command so if you do any
+# pre-processing of your env.sh, like above, comment this next line out
+# NOTE: Apparently using a the dot syntax instead of the `source`
+# command is more portable. "$1" is variable with the path to env.sh
+. "$1"
+
+# DO NOT MODIFY BELOW THIS POINT
+# Environment needs to be printed to console so it can be read in by iron
+printenv