Keep environment values out of --help, and fix the uninstall order

README.md

@@ -130,13 +130,15 @@ binary in `/usr/local/bin` or `~/.local/bin` (or the `--dir` you gave) and the m
 
 ```sh
 hodeishield logout                      # revokes the sign-in and removes the stored token
+rm -f "$(hodeishield config path)"      # optional: the settings
 rm "$(command -v hodeishield)"          # the binary
 rm -f /usr/local/share/man/man1/hodeishield*.1     # man pages (~/.local/share/man/man1 for ~/.local/bin)
-rm -f "$(hodeishield config path)"      # optional: the settings
 ```
 
-Run `hodeishield logout` first; with the binary gone it can no longer do it. Remove the completion
-files too if you copied them.
+Run `hodeishield logout` and `config path` first; with the binary gone neither can run. If you
+installed completions from `hodeishield completions`, remove the file where you saved it, usually
+`~/.local/share/bash-completion/completions/hodeishield` (bash), `_hodeishield` in a directory of
+your `fpath` (zsh) or `~/.config/fish/completions/hodeishield.fish` (fish).
 
 On Windows, `hodeishield logout` first removes the sign-in from Credential Manager, then:
 
@@ -285,6 +287,7 @@ fail with a missing-source error), and the same `verify-blob` command works with
 ```powershell
 (Get-FileHash .\hodeishield-0.5.0-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash.ToLower()
 Select-String hodeishield-0.5.0-x86_64-pc-windows-msvc.zip SHA256SUMS      # the two hashes must match
+# the same two lines with .msi for the MSI
 cosign verify-blob .\hodeishield-0.5.0-x86_64-pc-windows-msvc.zip `
   --bundle .\hodeishield-0.5.0-x86_64-pc-windows-msvc.zip.sigstore.json `
   --certificate-identity https://github.com/Hodeitek/hodeishield-cli/.github/workflows/release.yml@refs/tags/v0.5.0 `

crates/hodeishield-cli/src/cli.rs

@@ -43,6 +43,7 @@ pub struct Cli {
         global = true,
         help_heading = "Global options",
         env = "HODEISHIELD_PROFILE",
+        hide_env_values = true,
         value_name = "NAME"
     )]
     pub profile: Option<String>,
@@ -53,6 +54,7 @@ pub struct Cli {
         global = true,
         help_heading = "Global options",
         env = "HODEISHIELD_API_URL",
+        hide_env_values = true,
         value_name = "URL"
     )]
     pub api_url: Option<String>,

crates/hodeishield-cli/tests/cli.rs

@@ -108,6 +108,27 @@ fn assert_no_key(output: &std::process::Output) {
     );
 }
 
+/// `--help` names the variables but never prints their values, which end up in terminals and CI logs.
+#[test]
+fn help_does_not_print_the_values_of_the_environment() {
+    let env = Env::new();
+    let output = env
+        .cmd()
+        .env("HODEISHIELD_API_URL", "https://api-from-env.example.test")
+        .env("HODEISHIELD_PROFILE", "profile-from-env")
+        .env("HODEISHIELD_API_KEY", KEY)
+        .arg("--help")
+        .output()
+        .expect("run");
+    let text = String::from_utf8_lossy(&output.stdout);
+    assert!(text.contains("[env: HODEISHIELD_API_URL]"), "{text}");
+    assert!(
+        !text.contains("api-from-env") && !text.contains("profile-from-env"),
+        "{text}"
+    );
+    assert_no_key(&output);
+}
+
 #[test]
 fn vendors_list_prints_a_table_and_the_next_page() {
     let env = Env::new();

docs/user-information.md

@@ -89,7 +89,7 @@ logged, HTTPS only, no redirects followed, signed releases) is in
   has no option to skip certificate verification: install your organisation's CA in that store
   ([Networking](../README.md#networking-proxies-and-tls-inspection)).
 - **Cut access you no longer need**: `hodeishield logout`, or revoke the CLI's access in the app
-  under **Account → Application access**; revoke an API key in the app as soon as it is not needed
+  under **Account → Applications**; revoke an API key in the app as soon as it is not needed
   or may have been exposed.
 
 Known limitations:
@@ -141,7 +141,7 @@ To stop using `hodeishield` on a machine and leave nothing behind:
 1. **Sign out of every profile you signed in to**: `hodeishield logout`, and
    `hodeishield logout --profile <name>` for each other profile. This revokes the token at the app
    and removes it from the system keychain. If the CLI warns that the app did not confirm the
-   revocation, revoke the CLI's access in the app under **Account → Application access**.
+   revocation, revoke the CLI's access in the app under **Account → Applications**.
 2. **Revoke the tenant API keys** the machine used, in the app, and remove them from the
    environment and secret stores that held them.
 3. **Delete the configuration file and the update-check record.** `hodeishield config path` prints
@@ -169,7 +169,7 @@ To stop using `hodeishield` on a machine and leave nothing behind:
    | `cargo install` | `cargo uninstall hodeishield-cli` |
 
 If the CLI is already gone and a sign-in was left in the keychain, revoke the access in the app
-(**Account → Application access**), then delete the entry, one per profile, whose service is
+(**Account → Applications**), then delete the entry, one per profile, whose service is
 `hodeishield-cli` and whose account is the profile name: on macOS with Keychain Access or
 `security delete-generic-password -s hodeishield-cli -a <profile>`, on Windows in Credential Manager
 (*Windows Credentials*, named `<profile>.hodeishield-cli`), and on Linux with