> On linux, other users can see your command line (ps aux)

On FreeBSD I like doing:

/boot/loader.conf: mac_seeotheruids_load="YES"

/etc/sysctl.conf: security.mac.seeotheruids.enabled="1"

Which restricts users to seeing only their own processes. You can make exceptions for a specific group or users with the same primary group.

I still don't put anything sensitive in a command line, of course.