It can also be nice to use HISTCONTROL=ignorespace
If you're planning on keeping a lot of history, ignorespace makes it easy to avoid inserting commands with sensitive info. A well-placed $(cat) can work too.
$ PASSWORD=hunter2 # sensitive info doesn't go into history
$ curl -O http://name:$PASSWORD@server/path # command with correct syntax does go into history