Use getpass() instead of CLI arg for config secret