Usually I do ^ while setting it as a variable, then I can still save the regular command to the history without the secret.