title: How is git credential manager secure if it displays token
body: <p>I have <code>credential.helper=manager-core</code>, which is the new helper for windows credential manager. I don't understand how is it secure if you can get git to display your credentials with <code>git credential fill</code>.</p>
  <p><strong>Steps to reproduce</strong></p>
  <ol>
  <li>confirm the credential helper by executing command <code>git config --system --list</code>. If you are running <strong>Git for Windows 2.29</strong> or later, then you should be able to see <code>credential.helper=manager-core</code> in the list. For earlier versions the <code>credential.helper</code> is set to <code>manager</code> and not <code>manager-core</code>. I'm running the latest <strong>Git For Windows 2.29.2</strong> , so for me it return <code>manager-core</code>.</li>
  <li>Next, if your credentials have been stored by the helper, then below command should return the credentials on stdout :</li>
  </ol>
  <pre><code>git credential fill
  protocol=https
  host=github.com`
  &lt;HIT ENTER KEY TWICE, as A blank line signals input completion&gt;
  </code></pre>
  <ol start="3">
  <li>The credentials should now display on your console. It is able to display password/token based on  whatever you initially configured your git with. In my case I had authenticated with a GitHub personal access token and it displayed that pat.</li>
  </ol>