[arve0]

> without exposing the secret to the shell history file

Any command in shell with a space before it will be omitted from history.

Agree it should take input from stdin.

[sirn]

This requires `setopt HIST_IGNORE_SPACE` (zsh) or `HISTCONTROL=ignorespace`/`HISTCONTROL=ignoreboth` (bash/ksh) to be set and may not be enabled by default in many distros (e.g. NixOS doesn't, Alpine doesn’t, etc).

Always check your shell before assuming this will work!