fix(cli): hide DATABASE_URL value from help

CHANGELOG.md

@@ -4,6 +4,10 @@ Notable changes between releases. Detailed migration notes for storage transitio
 
 ## [Unreleased]
 
+### Fixed
+
+- **`awa --help` no longer prints the resolved `DATABASE_URL`.** The CLI still accepts `DATABASE_URL` as its database target, and help still identifies the environment variable, but credentials and other connection details from its current value are hidden.
+
 ## [0.6.6] — 2026-08-14
 
 Patch release: storage-transition convergence and recovery fixes. No migrations, schema changes, or public API changes.

awa-cli/src/main.rs

@@ -14,7 +14,7 @@ mod storage_wait;
 )]
 struct Cli {
     /// Database URL (not required for migrate --sql without --pending)
-    #[arg(long, env = "DATABASE_URL")]
+    #[arg(long, env = "DATABASE_URL", hide_env_values = true)]
     database_url: Option<String>,
 
     #[command(subcommand)]

awa-cli/tests/help_cli_test.rs

@@ -0,0 +1,22 @@
+use assert_cmd::Command;
+
+#[test]
+fn help_does_not_disclose_environment_database_url() {
+    let secret_url = "postgres://secret-user:secret-password@db.example/awa";
+    let output = Command::cargo_bin("awa")
+        .expect("awa binary")
+        .env("DATABASE_URL", secret_url)
+        .arg("--help")
+        .output()
+        .expect("run awa --help");
+
+    assert!(output.status.success());
+    let rendered = format!(
+        "{}{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    assert!(rendered.contains("DATABASE_URL"));
+    assert!(!rendered.contains(secret_url));
+    assert!(!rendered.contains("secret-password"));
+}