I have seen this in the past and failed to ask why..
When configuring an new device and validating the user login why does NCM display the user *** password **** openly????
Username: domain\account (using ad integrated tacacs)
Password: mypassword (in the open!) since the application knows it is passing a password please ***** the text, unless there is an option to display.
