IIRC it will actually error out when you attempt setting a config value named

*secret*

and force you to specify either

--secure

or

--plaintext

(all from memory, syntax may be off)