[bash] Stop passing secrets as command-line arguments

When you do this: mysql -u admin -pMyS3cretPass123 Every user on the system sees your password in plain text: ps aux | grep mysql This isn't a bug. Unix exposes every process's full command line through `/proc/PID/cmdline`, readable by any unprivileged user. **IT'S NOT A BRIEF FLASH EITHER -- THE PASSWORD SITS THERE FOR THE ENTIRE LIFETIME OF THE PROCESS.** Any user on your box can run this and harvest credentials in real time: while true; do cat /proc/*/cmdline 2>/dev/null | tr '\0' ' ' | grep -i 'password\|secret\|token' sleep 0.1 done That checks every running process 10 times per second. Zero privileges needed. Same problem with curl: curl -u admin:password123 https://api.example.com And docker: docker run -e DB_PASSWORD=secret myapp The fix is to pass secrets through stdin, which never hits the process table: # mysql -- prompt instead of argv mysql -u admin -p # curl -- header from stdin curl -H @- https://api.example.com <<< "Authorization: Bearer $TOKEN" # curl -- creds from a file curl --netrc-file /path/to/netrc https://api.example.com # docker -- env from file, not command line docker run --env-file .env myapp # general pattern -- pipe secrets, don't pass them some_command --password-stdin <<< "$SECRET" The `-p` with no argument tells mysql to read the password from the terminal instead of argv. The `<<<` here string and `@-` pass data through stdin. Neither shows up in `ps` or `/proc`. Bash and any POSIX shell. This isn't shell-specific -- it's how Unix works.