do not mask throwaway credentials

2026-08-13 02:05:51 +00:00
parent 2809072812
commit c6cb958ba5
1 changed files with 12 additions and 0 deletions
@@ -95,6 +95,18 @@ asterisks of the same length, overwriting in place so the live session's
 appends are not lost. Read the header before changing it; the same-length,
 same-inode detail is load-bearing.
 **Do not mask a throwaway.** He sometimes sets a real password aside, hands you
 a temporary one so you can drive an API — Nginx Proxy Manager, a router, a
 service admin — and reverts it afterwards. Leave those in the history. They are
 worthless once reverted, and he may need to read the value back while he is
 still working. Masking one destroys something he is actively using.
 Take his word for which kind it is. "Temporary", "throwaway", "I'll change it
 back", or a password he clearly just invented for this task — leave it. A token
 he pastes from a password manager or a provider console — mask it. When it is
 genuinely unclear, mask it and say so in one line, so he can re-paste if he
 still needs it.
 Two habits that matter more than the cleanup:
 - **Keep secrets off command lines.** Pass them by stdin or an env var. Argv is