CLI GET/EDIT Method Security Concern

Hi @1PassUser39398, thanks for reaching out!

I'll be happy to submit a feature request for a flag option to conceal passwords when using the CLI! Can you tell me a bit more about how you're using the CLI in your workflow and why this is causing concern? I can then share your feedback with our Product team, so that they have a better insight into what you're trying to accomplish and how the flag will improve your experience.

I look forward to hearing from you!

-David

Hi David, the use case is fairly simple. One of our vendors changed their apex domain so we now need to iterate through thousands of credentials updating the URL. To my surprise, when the EDIT command is used, the URL is updated, but the entire item is given in the response with the password in plain text. In your document on https://developer.1password.com/docs/cli/reference/management-commands/item page, you state "Caution: Command arguments can be visible to other processes on your machine". If responses are also visible (or logged), whether natively or using malware, the CLI becomes insecure.

@1PassUser39398

I appreciate you sharing those details! Our team is looking into improvements for handling concealed fields with 1Password CLI. I've submitted your request to the Product team, so that they can consider adding a flag for concealing sensitive fields when running 1Password CLI commands.

I'm unable to provide any information on when this may be released, but it will be noted in our release notes if it is implemented.

Let me know if there's anything else I can help with!

-David

ref: PB-40901593
ref: dev/b5/op#4158