We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Passphrase given in the command line is visible in the process list  
#### Problem Description
Mitmproxy accepts cert-passphrase as one of the command-line options. If the user gives a passphrase like this while running the mitmproxy, anyone having access to a command line on that server can see the passphrase by listing the running processes.

#### Steps to reproduce the behavior:
1. Create a self-signed certificate using openssl, make sure you give a passphrase for the certificate. 
2. Run mitmproxy/mitmdump/mitmweb with the command line options as shown
mitmdump --certs *.mydomain.com=mycert.pem cert-passphrase abcd 
3. Take a Linux terminal and issue the command ps -ef | grep mitm
4. You can see the passphrase given to mitmdump command in clear text

This is a security issue in my opinion. Some programs effectively hide such sensitive inputs that are given as command-line arguments. They do this by rewriting the command line args in an obfuscated manner and by rerunning the program by itself. In this way, the sensitive data that came along via command-line arguments will be visible for a split second, but that is still better than making them always visible as long as the program is running.



--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `mitmproxy/options.py`
Content:
```
1 from typing import Optional, Sequence
2 
3 from mitmproxy import optmanager
4 
5 CONF_DIR = "~/.mitmproxy"
6 CONF_BASENAME = "mitmproxy"
7 LISTEN_PORT = 8080
8 CONTENT_VIEW_LINES_CUTOFF = 512
9 KEY_SIZE = 2048
10 
11 
12 class Options(optmanager.OptManager):
13 
14     def __init__(self, **kwargs) -> None:
15         super().__init__()
16         self.add_option(
17             "server", bool, True,
18             "Start a proxy server. Enabled by default."
19         )
20         self.add_option(
21             "showhost", bool, False,
22             "Use the Host header to construct URLs for display."
23         )
24 
25         # Proxy options
26         self.add_option(
27             "add_upstream_certs_to_client_chain", bool, False,
28             """
29             Add all certificates of the upstream server to the certificate chain
30             that will be served to the proxy client, as extras.
31             """
32         )
33         self.add_option(
34             "confdir", str, CONF_DIR,
35             "Location of the default mitmproxy configuration files."
36         )
37         self.add_option(
38             "certs", Sequence[str], [],
39             """
40             SSL certificates of the form "[domain=]path". The domain may include
41             a wildcard, and is equal to "*" if not specified. The file at path
42             is a certificate in PEM format. If a private key is included in the
43             PEM, it is used, else the default key in the conf dir is used. The
44             PEM file should contain the full certificate chain, with the leaf
45             certificate as the first entry.
46             """
47         )
48         self.add_option(
49             "cert_passphrase", Optional[str], None,
50             "Passphrase for decrypting the private key provided in the --cert option."
51         )
52         self.add_option(
53             "ciphers_client", Optional[str], None,
54             "Set supported ciphers for client connections using OpenSSL syntax."
55         )
56         self.add_option(
57             "ciphers_server", Optional[str], None,
58             "Set supported ciphers for server connections using OpenSSL syntax."
59         )
60         self.add_option(
61             "client_certs", Optional[str], None,
62             "Client certificate file or directory."
63         )
64         self.add_option(
65             "ignore_hosts", Sequence[str], [],
66             """
67             Ignore host and forward all traffic without processing it. In
68             transparent mode, it is recommended to use an IP address (range),
69             not the hostname. In regular mode, only SSL traffic is ignored and
70             the hostname should be used. The supplied value is interpreted as a
71             regular expression and matched on the ip or the hostname.
72             """
73         )
74         self.add_option(
75             "allow_hosts", Sequence[str], [],
76             "Opposite of --ignore-hosts."
77         )
78         self.add_option(
79             "listen_host", str, "",
80             "Address to bind proxy to."
81         )
82         self.add_option(
83             "listen_port", int, LISTEN_PORT,
84             "Proxy service port."
85         )
86         self.add_option(
87             "mode", str, "regular",
88             """
89             Mode can be "regular", "transparent", "socks5", "reverse:SPEC",
90             or "upstream:SPEC". For reverse and upstream proxy modes, SPEC
91             is host specification in the form of "http[s]://host[:port]".
92             """
93         )
94         self.add_option(
95             "upstream_cert", bool, True,
96             "Connect to upstream server to look up certificate details."
97         )
98 
99         self.add_option(
100             "http2", bool, True,
101             "Enable/disable HTTP/2 support. "
102             "HTTP/2 support is enabled by default.",
103         )
104         self.add_option(
105             "websocket", bool, True,
106             "Enable/disable WebSocket support. "
107             "WebSocket support is enabled by default.",
108         )
109         self.add_option(
110             "rawtcp", bool, True,
111             "Enable/disable raw TCP connections. "
112             "TCP connections are enabled by default. "
113         )
114         self.add_option(
115             "ssl_insecure", bool, False,
116             "Do not verify upstream server SSL/TLS certificates."
117         )
118         self.add_option(
119             "ssl_verify_upstream_trusted_confdir", Optional[str], None,
120             """
121             Path to a directory of trusted CA certificates for upstream server
122             verification prepared using the c_rehash tool.
123             """
124         )
125         self.add_option(
126             "ssl_verify_upstream_trusted_ca", Optional[str], None,
127             "Path to a PEM formatted trusted CA certificate."
128         )
129         self.add_option(
130             "tcp_hosts", Sequence[str], [],
131             """
132             Generic TCP SSL proxy mode for all hosts that match the pattern.
133             Similar to --ignore-hosts, but SSL connections are intercepted.
134             The communication contents are printed to the log in verbose mode.
135             """
136         )
137         self.add_option(
138             "content_view_lines_cutoff", int, CONTENT_VIEW_LINES_CUTOFF,
139             """
140             Flow content view lines limit. Limit is enabled by default to
141             speedup flows browsing.
142             """
143         )
144         self.add_option(
145             "key_size", int, KEY_SIZE,
146             """
147             TLS key size for certificates and CA.
148             """
149         )
150 
151         self.update(**kwargs)
152
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/mitmproxy/options.py b/mitmproxy/options.py
--- a/mitmproxy/options.py
+++ b/mitmproxy/options.py
@@ -47,7 +47,12 @@
         )
         self.add_option(
             "cert_passphrase", Optional[str], None,
-            "Passphrase for decrypting the private key provided in the --cert option."
+            """
+            Passphrase for decrypting the private key provided in the --cert option.
+
+            Note that passing cert_passphrase on the command line makes your passphrase visible in your system's
+            process list. Specify it in config.yaml to avoid this.
+            """
         )
         self.add_option(
             "ciphers_client", Optional[str], None,

{"golden_diff": "diff --git a/mitmproxy/options.py b/mitmproxy/options.py\n--- a/mitmproxy/options.py\n+++ b/mitmproxy/options.py\n@@ -47,7 +47,12 @@\n         )\n         self.add_option(\n             \"cert_passphrase\", Optional[str], None,\n-            \"Passphrase for decrypting the private key provided in the --cert option.\"\n+            \"\"\"\n+            Passphrase for decrypting the private key provided in the --cert option.\n+\n+            Note that passing cert_passphrase on the command line makes your passphrase visible in your system's\n+            process list. Specify it in config.yaml to avoid this.\n+            \"\"\"\n         )\n         self.add_option(\n             \"ciphers_client\", Optional[str], None,\n", "issue": "Passphrase given in the command line is visible in the process list  \n#### Problem Description\r\nMitmproxy accepts cert-passphrase as one of the command-line options. If the user gives a passphrase like this while running the mitmproxy, anyone having access to a command line on that server can see the passphrase by listing the running processes.\r\n\r\n#### Steps to reproduce the behavior:\r\n1. Create a self-signed certificate using openssl, make sure you give a passphrase for the certificate. \r\n2. Run mitmproxy/mitmdump/mitmweb with the command line options as shown\r\nmitmdump --certs *.mydomain.com=mycert.pem cert-passphrase abcd \r\n3. Take a Linux terminal and issue the command ps -ef | grep mitm\r\n4. You can see the passphrase given to mitmdump command in clear text\r\n\r\nThis is a security issue in my opinion. Some programs effectively hide such sensitive inputs that are given as command-line arguments. They do this by rewriting the command line args in an obfuscated manner and by rerunning the program by itself. In this way, the sensitive data that came along via command-line arguments will be visible for a split second, but that is still better than making them always visible as long as the program is running.\r\n\r\n\n", "before_files": [{"content": "from typing import Optional, Sequence\n\nfrom mitmproxy import optmanager\n\nCONF_DIR = \"~/.mitmproxy\"\nCONF_BASENAME = \"mitmproxy\"\nLISTEN_PORT = 8080\nCONTENT_VIEW_LINES_CUTOFF = 512\nKEY_SIZE = 2048\n\n\nclass Options(optmanager.OptManager):\n\n    def __init__(self, **kwargs) -> None:\n        super().__init__()\n        self.add_option(\n            \"server\", bool, True,\n            \"Start a proxy server. Enabled by default.\"\n        )\n        self.add_option(\n            \"showhost\", bool, False,\n            \"Use the Host header to construct URLs for display.\"\n        )\n\n        # Proxy options\n        self.add_option(\n            \"add_upstream_certs_to_client_chain\", bool, False,\n            \"\"\"\n            Add all certificates of the upstream server to the certificate chain\n            that will be served to the proxy client, as extras.\n            \"\"\"\n        )\n        self.add_option(\n            \"confdir\", str, CONF_DIR,\n            \"Location of the default mitmproxy configuration files.\"\n        )\n        self.add_option(\n            \"certs\", Sequence[str], [],\n            \"\"\"\n            SSL certificates of the form \"[domain=]path\". The domain may include\n            a wildcard, and is equal to \"*\" if not specified. The file at path\n            is a certificate in PEM format. If a private key is included in the\n            PEM, it is used, else the default key in the conf dir is used. The\n            PEM file should contain the full certificate chain, with the leaf\n            certificate as the first entry.\n            \"\"\"\n        )\n        self.add_option(\n            \"cert_passphrase\", Optional[str], None,\n            \"Passphrase for decrypting the private key provided in the --cert option.\"\n        )\n        self.add_option(\n            \"ciphers_client\", Optional[str], None,\n            \"Set supported ciphers for client connections using OpenSSL syntax.\"\n        )\n        self.add_option(\n            \"ciphers_server\", Optional[str], None,\n            \"Set supported ciphers for server connections using OpenSSL syntax.\"\n        )\n        self.add_option(\n            \"client_certs\", Optional[str], None,\n            \"Client certificate file or directory.\"\n        )\n        self.add_option(\n            \"ignore_hosts\", Sequence[str], [],\n            \"\"\"\n            Ignore host and forward all traffic without processing it. In\n            transparent mode, it is recommended to use an IP address (range),\n            not the hostname. In regular mode, only SSL traffic is ignored and\n            the hostname should be used. The supplied value is interpreted as a\n            regular expression and matched on the ip or the hostname.\n            \"\"\"\n        )\n        self.add_option(\n            \"allow_hosts\", Sequence[str], [],\n            \"Opposite of --ignore-hosts.\"\n        )\n        self.add_option(\n            \"listen_host\", str, \"\",\n            \"Address to bind proxy to.\"\n        )\n        self.add_option(\n            \"listen_port\", int, LISTEN_PORT,\n            \"Proxy service port.\"\n        )\n        self.add_option(\n            \"mode\", str, \"regular\",\n            \"\"\"\n            Mode can be \"regular\", \"transparent\", \"socks5\", \"reverse:SPEC\",\n            or \"upstream:SPEC\". For reverse and upstream proxy modes, SPEC\n            is host specification in the form of \"http[s]://host[:port]\".\n            \"\"\"\n        )\n        self.add_option(\n            \"upstream_cert\", bool, True,\n            \"Connect to upstream server to look up certificate details.\"\n        )\n\n        self.add_option(\n            \"http2\", bool, True,\n            \"Enable/disable HTTP/2 support. \"\n            \"HTTP/2 support is enabled by default.\",\n        )\n        self.add_option(\n            \"websocket\", bool, True,\n            \"Enable/disable WebSocket support. \"\n            \"WebSocket support is enabled by default.\",\n        )\n        self.add_option(\n            \"rawtcp\", bool, True,\n            \"Enable/disable raw TCP connections. \"\n            \"TCP connections are enabled by default. \"\n        )\n        self.add_option(\n            \"ssl_insecure\", bool, False,\n            \"Do not verify upstream server SSL/TLS certificates.\"\n        )\n        self.add_option(\n            \"ssl_verify_upstream_trusted_confdir\", Optional[str], None,\n            \"\"\"\n            Path to a directory of trusted CA certificates for upstream server\n            verification prepared using the c_rehash tool.\n            \"\"\"\n        )\n        self.add_option(\n            \"ssl_verify_upstream_trusted_ca\", Optional[str], None,\n            \"Path to a PEM formatted trusted CA certificate.\"\n        )\n        self.add_option(\n            \"tcp_hosts\", Sequence[str], [],\n            \"\"\"\n            Generic TCP SSL proxy mode for all hosts that match the pattern.\n            Similar to --ignore-hosts, but SSL connections are intercepted.\n            The communication contents are printed to the log in verbose mode.\n            \"\"\"\n        )\n        self.add_option(\n            \"content_view_lines_cutoff\", int, CONTENT_VIEW_LINES_CUTOFF,\n            \"\"\"\n            Flow content view lines limit. Limit is enabled by default to\n            speedup flows browsing.\n            \"\"\"\n        )\n        self.add_option(\n            \"key_size\", int, KEY_SIZE,\n            \"\"\"\n            TLS key size for certificates and CA.\n            \"\"\"\n        )\n\n        self.update(**kwargs)\n", "path": "mitmproxy/options.py"}], "after_files": [{"content": "from typing import Optional, Sequence\n\nfrom mitmproxy import optmanager\n\nCONF_DIR = \"~/.mitmproxy\"\nCONF_BASENAME = \"mitmproxy\"\nLISTEN_PORT = 8080\nCONTENT_VIEW_LINES_CUTOFF = 512\nKEY_SIZE = 2048\n\n\nclass Options(optmanager.OptManager):\n\n    def __init__(self, **kwargs) -> None:\n        super().__init__()\n        self.add_option(\n            \"server\", bool, True,\n            \"Start a proxy server. Enabled by default.\"\n        )\n        self.add_option(\n            \"showhost\", bool, False,\n            \"Use the Host header to construct URLs for display.\"\n        )\n\n        # Proxy options\n        self.add_option(\n            \"add_upstream_certs_to_client_chain\", bool, False,\n            \"\"\"\n            Add all certificates of the upstream server to the certificate chain\n            that will be served to the proxy client, as extras.\n            \"\"\"\n        )\n        self.add_option(\n            \"confdir\", str, CONF_DIR,\n            \"Location of the default mitmproxy configuration files.\"\n        )\n        self.add_option(\n            \"certs\", Sequence[str], [],\n            \"\"\"\n            SSL certificates of the form \"[domain=]path\". The domain may include\n            a wildcard, and is equal to \"*\" if not specified. The file at path\n            is a certificate in PEM format. If a private key is included in the\n            PEM, it is used, else the default key in the conf dir is used. The\n            PEM file should contain the full certificate chain, with the leaf\n            certificate as the first entry.\n            \"\"\"\n        )\n        self.add_option(\n            \"cert_passphrase\", Optional[str], None,\n            \"\"\"\n            Passphrase for decrypting the private key provided in the --cert option.\n\n            Note that passing cert_passphrase on the command line makes your passphrase visible in your system's\n            process list. Specify it in config.yaml to avoid this.\n            \"\"\"\n        )\n        self.add_option(\n            \"ciphers_client\", Optional[str], None,\n            \"Set supported ciphers for client connections using OpenSSL syntax.\"\n        )\n        self.add_option(\n            \"ciphers_server\", Optional[str], None,\n            \"Set supported ciphers for server connections using OpenSSL syntax.\"\n        )\n        self.add_option(\n            \"client_certs\", Optional[str], None,\n            \"Client certificate file or directory.\"\n        )\n        self.add_option(\n            \"ignore_hosts\", Sequence[str], [],\n            \"\"\"\n            Ignore host and forward all traffic without processing it. In\n            transparent mode, it is recommended to use an IP address (range),\n            not the hostname. In regular mode, only SSL traffic is ignored and\n            the hostname should be used. The supplied value is interpreted as a\n            regular expression and matched on the ip or the hostname.\n            \"\"\"\n        )\n        self.add_option(\n            \"allow_hosts\", Sequence[str], [],\n            \"Opposite of --ignore-hosts.\"\n        )\n        self.add_option(\n            \"listen_host\", str, \"\",\n            \"Address to bind proxy to.\"\n        )\n        self.add_option(\n            \"listen_port\", int, LISTEN_PORT,\n            \"Proxy service port.\"\n        )\n        self.add_option(\n            \"mode\", str, \"regular\",\n            \"\"\"\n            Mode can be \"regular\", \"transparent\", \"socks5\", \"reverse:SPEC\",\n            or \"upstream:SPEC\". For reverse and upstream proxy modes, SPEC\n            is host specification in the form of \"http[s]://host[:port]\".\n            \"\"\"\n        )\n        self.add_option(\n            \"upstream_cert\", bool, True,\n            \"Connect to upstream server to look up certificate details.\"\n        )\n\n        self.add_option(\n            \"http2\", bool, True,\n            \"Enable/disable HTTP/2 support. \"\n            \"HTTP/2 support is enabled by default.\",\n        )\n        self.add_option(\n            \"websocket\", bool, True,\n            \"Enable/disable WebSocket support. \"\n            \"WebSocket support is enabled by default.\",\n        )\n        self.add_option(\n            \"rawtcp\", bool, True,\n            \"Enable/disable raw TCP connections. \"\n            \"TCP connections are enabled by default. \"\n        )\n        self.add_option(\n            \"ssl_insecure\", bool, False,\n            \"Do not verify upstream server SSL/TLS certificates.\"\n        )\n        self.add_option(\n            \"ssl_verify_upstream_trusted_confdir\", Optional[str], None,\n            \"\"\"\n            Path to a directory of trusted CA certificates for upstream server\n            verification prepared using the c_rehash tool.\n            \"\"\"\n        )\n        self.add_option(\n            \"ssl_verify_upstream_trusted_ca\", Optional[str], None,\n            \"Path to a PEM formatted trusted CA certificate.\"\n        )\n        self.add_option(\n            \"tcp_hosts\", Sequence[str], [],\n            \"\"\"\n            Generic TCP SSL proxy mode for all hosts that match the pattern.\n            Similar to --ignore-hosts, but SSL connections are intercepted.\n            The communication contents are printed to the log in verbose mode.\n            \"\"\"\n        )\n        self.add_option(\n            \"content_view_lines_cutoff\", int, CONTENT_VIEW_LINES_CUTOFF,\n            \"\"\"\n            Flow content view lines limit. Limit is enabled by default to\n            speedup flows browsing.\n            \"\"\"\n        )\n        self.add_option(\n            \"key_size\", int, KEY_SIZE,\n            \"\"\"\n            TLS key size for certificates and CA.\n            \"\"\"\n        )\n\n        self.update(**kwargs)\n", "path": "mitmproxy/options.py"}]}