Password/url might be exposed in commandline invocation info of the process, it'd better to have a stdin approach to pass these secrets.