Add doc warning about shell history logging for commands that accept credentials

• I have searched the issues of this repo and believe that this is not a duplicate.
• I have searched the documentation and believe that my question is not covered.

Feature Request

I think to make sure private keys/password are secured, we should remove poetry config commands that have any sensitive information from the terminal history (or replace sensitive information with stars?):

$ poetry config http-basic.mypi __token__ azpAEkFPOK5pokErkPOFd
$ history | grep "poetry config http-basic"
poetry config http-basic.mypi __token__ azpAEkFPOK5pokErkPOFd

Expected behaviour would be to have:

$ poetry config http-basic.mypi __token__ azpAEkFPOK5pokErkPOFd
$ history | grep "poetry config http-basic"
poetry config http-basic.mypi __token__ azp***********Fd

It seems like a bit of work to make that work in every situation, but on the other hand its probably relatively easy for the most common use cases (bash/zsh/fish). Did anyone worked on that yet?

[abn]

We should just add a warning about this risk in the documentation alongside examples talking about configuring secrets. Maybe update the title and description as such.

[sinoroc]

In theory it is a good idea. In practice that seems quite complicated, if not impossible. But…

1. If I remember right, a good trick to know for such cases (at least in bash) is to prefix the command with an empty space so that it is not added to the history.

• https://stackoverflow.com/a/8473153

2. If you omit the value, then it is prompted interactively, and thus the actual token is not added to the history.

$ poetry config http-basic.mypi __token__
Password: 
$ history | grep "poetry config http-basic"
poetry config http-basic.mypi __token__