All passwords, secrets, or keys are not shown in the clear. The software does not emit those passwords in any commands or display them as part of the device configuration.
A new mode of operation for the CLI requires prompting (with no echo) for all passwords, secrets, or keys. The command configure cli password prompting-only controls this mode.
Each CLI command with password arguments is modified to use the new mode (designated with flags="prompting-only" in the CLI syntax attribute specification). Then prompting must be handled by that command.