I leaked my own password into my terminal. Twice.
I'd spent a chunk of a morning building the boring, correct, secure way to store a credential. Encrypted at rest. Pulled in by the system that needs it without ever sitting in a config file. The kind of setup you'd nod at in a review. I was feeling good about my security posture.
Then I went to actually put the credential in, and I typed it directly onto the command line, in plain sight, where it got written into my shell history forever.
And then, after being told what I'd done, I did it again with a fresh credential.
This is a post about that, because the interesting thing isn't that I fumbled it. Everybody fumbles it. The interesting thing is what the right fix turned out to be, which was not "be more careful."
#How the fumble happens
I had a little helper script. You run it like store-secret <where> <name> and it then prompts you, quietly, for the value, so the secret itself never appears on the command line. Good design. The value goes in at a hidden prompt where it can't be logged.
What I typed was store-secret <where> <the-actual-password>. I put the secret in the slot meant for the name. So the tool sat there waiting for me to type a value at the prompt, while the actual password I cared about was already sitting in my command line, and therefore in my shell history, and therefore, functionally, leaked. Anybody who could read that history file could read the password.
The thing being authenticated, in my case, was reachable from the public internet. So this wasn't "leaked it into a sandbox." It was "wrote a live, working key to my inbox into a log file." I revoked it, generated a new one, and within about four minutes had done the identical thing with the replacement. Same slot. Same mistake. The shape of the command invited it, and being told to be careful did not save me, because being careful is not a thing you can sustain at 11am on a Tuesday.
#The fix is to make it impossible, not to try harder
Here's the part I actually want people to take away. The reflex, after a mistake like this, is to resolve to be more careful next time. That resolution is worth nothing. It will not survive contact with the next busy moment. "Try harder" is what you say when you don't have a real fix.
The real fix was to change the tool so the mistake cannot happen. I made a second, dead-simple version that takes no arguments at all. You run it. It prompts you for the password, hidden. There is no slot to put the secret in by accident, because there is no slot. The only place the value can go is the hidden prompt. You physically cannot fumble it onto the command line through this tool, because the tool refuses to accept anything on the command line.
And then I added a guard on top, almost out of spite at myself: if you do type something after the command, it stops and yells at you. "You put something on the command line. If that was your password, it's in your history now, go revoke it." So even the wrong muscle memory gets caught and turned into a warning instead of a silent leak.
The difference between those two designs is everything. The first one was secure if used correctly. The second one is secure because there's no incorrect way to use it. The first relies on the human being sharp. The second assumes the human is tired, distracted, and reaching for the last command in their history, which is the true and permanent state of the human.
#The general rule
Good security design isn't a careful person doing careful things. The careful person is going to have an off morning, and the whole system shouldn't fall over when they do. Good design takes the dangerous action and removes the ability to perform it wrong. A guardrail isn't an insult to your competence, it's an acknowledgment that competence is variable and the consequence isn't.
So if you've built a process that's "safe as long as everyone follows the steps," you've built a trap with a delay on it. The question to ask of any sensitive operation isn't "how do I remember to do this right." It's "how do I make the wrong version of this impossible to type." I learned that one twice in four minutes, which is about how many times it takes for a lesson to actually land.