When creating new envvars from the stdin prompt, the value is hidden while typing, but is then promptly displayed once done, defeating the purpose of hiding it in the first place.

tools.django-test@tools-sgebastion-10:~$ toolforge envvars create DJANGO_SUPERUSER_USERNAME
Enter the value of your envvar (prompt is hidden, hit Ctrl+C to abort):
name                       value
DJANGO_SUPERUSER_USERNAME  admin2

Suggestion:
Hide the prompt as a default. Add a --show flag or similar to see the value as you type. In both cases, do not automatically show the value.