--answer puts credentials in the process list and shell history. NEXUS_ANSWERS (one answer per line) is read at startup and removed from the environment so local shells don't inherit it, and either source now prints a warning when used outside --screenshot (SEC-20261012-018).