Note that if I access the property and call toUppercase on it, it will show me the password but this is kinda useless. What happens under the hood on pulumi side is something like

pass.toString = () => '[secret]';