Use Maskrun

Core Rule

Run potentially sensitive commands through maskrun -- instead of executing them directly.

Use this form:

maskrun -- <command> [args...]

Examples: