At some point, you may come across a trusted command-line utility prompting you for a password, and Emacs shell happily displaying each typed character to the nearby-world to see. Luckily, you can train Emacs to recognize new password prompts and hide the typed characters in modes deriving from comint. Append the password prompt REGEXP:
(setq comint-password-prompt-regexp (concat comint-password-prompt-regexp
"\\|"
"Password for red alert:"))