diff --git a/bin/config.sh b/bin/config.sh
index 8989ec8..bb7b432 100755
--- a/bin/config.sh
+++ b/bin/config.sh
@@ -77,10 +77,11 @@ fi
 
 # ── Prompting ────────────────────────────────────────────────────────────────
 
-# prompt_secret KEY "description" "url" [required] [prefix]
+# prompt_secret KEY "description" "url" [required] [prefix] [sensitive]
 # If an existing value is set, shows [****] and allows Enter to keep it.
+# sensitive defaults to "true" — input is hidden. Pass "false" for visible input.
 prompt_secret() {
-  local key="$1" desc="$2" url="${3:-}" required="${4:-}" prefix="${5:-}"
+  local key="$1" desc="$2" url="${3:-}" required="${4:-}" prefix="${5:-}" sensitive="${6:-true}"
   local label="" existing="${EXISTING[$key]:-}"
 
   if [ "$required" = "required" ]; then
@@ -98,7 +99,14 @@ prompt_secret() {
   else
     ask "${label}${desc}: "
   fi
-  read -r value
+
+  if [ "$sensitive" = "true" ] && [ -t 0 ]; then
+    read -rs value
+    # Print newline since -s suppresses it
+    echo ""
+  else
+    read -r value
+  fi
 
   # Empty input with existing value = keep existing
   if [ -z "$value" ] && [ -n "$existing" ]; then
@@ -203,7 +211,8 @@ prompt_secret "SLACK_ALLOWED_USERS" \
   "Slack user IDs (comma-separated)" \
   "Click your Slack profile → ··· → Copy member ID" \
   "required" \
-  "U"
+  "U" \
+  "false"
 
 echo ""
 
@@ -216,7 +225,8 @@ prompt_secret "AGENTMAIL_API_KEY" \
   "https://app.agentmail.to"
 
 prompt_secret "BAUDBOT_EMAIL" \
-  "Agent email address (e.g. agent@agentmail.to)"
+  "Agent email address (e.g. agent@agentmail.to)" \
+  "" "" "" "false"
 
 if [ -n "${ENV_VARS[AGENTMAIL_API_KEY]:-}" ]; then
   prompt_secret "BAUDBOT_SECRET" \
@@ -227,7 +237,8 @@ if [ -n "${ENV_VARS[AGENTMAIL_API_KEY]:-}" ]; then
   fi
 
   prompt_secret "BAUDBOT_ALLOWED_EMAILS" \
-    "Allowed sender emails (comma-separated)"
+    "Allowed sender emails (comma-separated)" \
+    "" "" "" "false"
 fi
 
 prompt_secret "SENTRY_AUTH_TOKEN" \
@@ -235,8 +246,8 @@ prompt_secret "SENTRY_AUTH_TOKEN" \
   "https://sentry.io/settings/account/api/auth-tokens/"
 
 if [ -n "${ENV_VARS[SENTRY_AUTH_TOKEN]:-}" ]; then
-  prompt_secret "SENTRY_ORG" "Sentry org slug"
-  prompt_secret "SENTRY_CHANNEL_ID" "Slack channel ID for Sentry alerts" "" "" "C"
+  prompt_secret "SENTRY_ORG" "Sentry org slug" "" "" "" "false"
+  prompt_secret "SENTRY_CHANNEL_ID" "Slack channel ID for Sentry alerts" "" "" "C" "false"
 fi
 
 prompt_secret "KERNEL_API_KEY" \
diff --git a/slack-bridge/package-lock.json b/slack-bridge/package-lock.json
index 56b9288..079116d 100644
--- a/slack-bridge/package-lock.json
+++ b/slack-bridge/package-lock.json
@@ -123,6 +123,7 @@
       "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
       "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/connect": "*",
         "@types/node": "*"
@@ -133,6 +134,7 @@
       "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
       "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*"
       }
@@ -154,6 +156,7 @@
       "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.1.1.tgz",
       "integrity": "sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*",
         "@types/qs": "*",
@@ -165,7 +168,8 @@
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.5.tgz",
       "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@types/jsonwebtoken": {
       "version": "9.0.10",
@@ -196,13 +200,15 @@
       "version": "6.14.0",
       "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.14.0.tgz",
       "integrity": "sha512-eOunJqu0K1923aExK6y8p6fsihYEn/BYuQ4g0CxAAgFc4b/ZLN4CrsRZ55srTdqoiLzU2B2evC+apEIxprEzkQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@types/range-parser": {
       "version": "1.2.7",
       "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
       "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@types/retry": {
       "version": "0.12.0",
@@ -215,6 +221,7 @@
       "resolved": "https://registry.npmjs.org/@types/send/-/send-1.2.1.tgz",
       "integrity": "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/node": "*"
       }
@@ -224,6 +231,7 @@
       "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-2.2.0.tgz",
       "integrity": "sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/http-errors": "*",
         "@types/node": "*"