When modifying a target system, any actual value saved in a "type=password" field can be exposed by modifying the DOM and setting the field to "type=text". This of course is not a safe method of working with secrets.

Two methods commonly used are (1) replacing the actual secret with a dummy value, as long as the dummy value is in the field it doesn't overwrite the configuration, and (2) using an empty value with a placeholder like placeholder="●●●●●". This fakes a value being there, even though the field is empty.

By doing so the secrets are no longer exposed to untrained or unexperienced HelloID admins or leaked accounts, improving security.

Even better would be to also verify during the Preview and Dry-Run options that these values are not part of the output, making sure they aren't exposed using Write-Information for example.