argv is world-readable in /proc for every local process while the connection attempt runs. Create the profile without the secret, then set it through nmcli's scriptable connection editor, which reads from stdin. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>