`bw list` shows plaintext credentials in the CLI https://bitwarden.com/help/cli/#list

I know this because I had the same surprised reaction