Feeding `psql` the password on the command line leaks it through the `psql` process' `/proc/<pid>/cmdline` file. Using `echo` to put the command in a file and then feeding `psql` the file should work around this, since `echo` is a bash builtin and thus shouldn't spawn a new process.
*** NixOS *** NixOS is a Linux distribution based on the purely functional package management system Nix. More information can be found at https://nixos.org/nixos and in the manual in doc/manual.