It seems that the diff command is not honouring `noEcho: true` for omitting sensitive information. (tested on latest version to date)