The password no longer has to be a command-line argument: it can come from --password-env, --password-stdin or a no-echo prompt (--password still works but warns). Plaintext storage is now an explicit opt-in (--no-encryption) instead of the result of a forgotten flag. See ADR 0038.