We already cleanup passwords from the command line, so if the user writes

clickhouse-client --password mysecret --query "SELECT 1"

and then run ps, it will appear as

clickhouse-client --password --query "SELECT 1"

But we don't do it if a password appears inside a query:

clickhouse-client --query "SELECT * FROM s3('s3://test/hello.csv', 'ASIAIOSFODNN7EXAMPLE', 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY')"

It should be presented as:

clickhouse-client --query "SELECT * FROM s3('s3://test/hello.csv', '', '')"