Shell Scripting / Bash Tricks

Stop passing raw passwords in shell script arguments

🧩 The Challenge

Everyone has done it at least once: you write a script that needs to authenticate to a database or an API, so you just pass the password as a flag and forget that it shows up plain as day in the ps output for every user on the server to see. It’s a total amateur move that keeps me up at night whenever I find it in an old repo.

💡 The Fix

Start using process substitution or heredocs to feed sensitive data into standard input instead of using command-line arguments. This keeps your credentials out of the global process table where any nosy user can snoop on them.

mysql -u user --password="$(cat /etc/my.cnf.d/db_secret)"
# Or if your command doesn't support reading from a pipe:
command --password-file <(echo "$SECRET_PASSWORD")

⚙️ Why It Works

Passing data via a file descriptor created by process substitution prevents the shell from ever exposing the secret in the process list, keeping your arguments clean and safe from prying eyes. Most utilities today are smart enough to look for a file path or accept input from stdin anyway.

🚀 Pro-Tip: Use a hardened file with 0400 permissions to store the password, not a plaintext environment variable.

Linux Tips & Tricks | © ngelinux.com | 8/27/2026