Consider integrating with an external secrets manager

[dgoguerra]

Such as: https://cloud.google.com/secret-manager (beta).

Maybe auth the CLI through OAuth? See: https://javascript-conference.com/wp-content/uploads/2019/02/Building_an_OAuth_Flow_in_a_Nodejs_CLI.pdf