Secondly, we are necessarily leaking the newly generated password into the process table as the shell expands the backticks (more details here). Sadly, the security(1) utility has no other method of non-interactively accepting a password but on the command-line. For this reason, it may be preferable to create the secret using the GUI application.
Is it possible to programmatically add passwords to the keychain without leaking them to the
ps -ef output?