Marginalia and hiding the value of password-ish variables

I like the way Marginalia adds annotations to minibuffer completion. I’m experimenting with streaming, so I’m trying to not leak passwords while playing around with marginalia. (I’ll probably mess up at some point. Please be nice! =) )

This is the annotator function:

(defun my/marginalia-annotate-variable (cand)
  "Annotate variable CAND with its documentation string."
  (when-let (sym (intern-soft cand))
    (marginalia--fields
     ((marginalia--symbol-class sym) :face 'marginalia-modified)
     ((let ((print-escape-newlines t)
            (print-escape-control-characters t)
            (print-escape-multibyte t))
        (prin1-to-string
         (cond
          ((string-match "pass" cand) "*******")
          ((boundp sym) (symbol-value sym))
          (t 'unbound))))
      :truncate (/ marginalia-truncate-width 3) :face 'marginalia-variable)
     ((documentation-property sym 'variable-documentation)
      :truncate marginalia-truncate-width :face 'marginalia-documentation))))

Something like the following code adds it to my annotator functions. The actual code I evaluate is in my use-package marginalia declaration in my Emacs config.

(setq marginalia-annotators
      '(marginalia-annotators-heavy
        marginalia-annotators-light))
(add-to-list 'marginalia-annotators-heavy
             '(symbol . my/marginalia-annotate-function-with-args))