LTS-5452: address review on the credentials step

Hidden prompt for the access key so it stays out of bash/zsh and
PSReadLine history (CodeRabbit); note the variables last for the current
session and how to spot an unset one; per-repo fixes from the code review.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: MihirR-BS

README.md

@@ -8,24 +8,29 @@ This repo contains samples for running [WebdriverIO](https://webdriver.io/) test
 * Clone the repo `git clone https://github.com/browserstack/browserstack-webdriverio-load-testing-sample.git`.
 * Set your credentials as environment variables, as described in [Set your credentials](#set-your-credentials).
 * Run `npm i` to install the dependencies.
-* Open the browserstack-load.yaml file and update it with the relevant load test configurations.
+* Open `browserstack-load.yml` and update it with the relevant load test configurations. Leave `userName` and `accessKey` as they are.
 
 ## Set your credentials
 
 The BrowserStack CLI reads your credentials from environment variables. Copy your username and access key from [Account Settings](https://www.browserstack.com/accounts/settings) and export them in the shell you run the test from:
 
 ```sh
-# macOS / Linux
+# macOS / Linux (bash or zsh)
 export BROWSERSTACK_USERNAME="<your-username>"
-export BROWSERSTACK_ACCESS_KEY="<your-access-key>"
+# Type the key at the prompt: it is not echoed, and it stays out of your shell history
+printf 'BrowserStack access key: '; read -rs BROWSERSTACK_ACCESS_KEY; echo
+export BROWSERSTACK_ACCESS_KEY
 ```
 
 ```powershell
 # Windows (PowerShell)
 $env:BROWSERSTACK_USERNAME = "<your-username>"
-$env:BROWSERSTACK_ACCESS_KEY = "<your-access-key>"
+# Type the key at the prompt: it is not echoed, and it stays out of your PowerShell history
+$env:BROWSERSTACK_ACCESS_KEY = [System.Net.NetworkCredential]::new('', (Read-Host -AsSecureString 'BrowserStack access key')).Password
 ```
 
+These variables last only for the current terminal session. If the CLI reports an authentication error, check that both are set in the terminal you run it from.
+
 **Never commit your credentials.** Leave the `userName` and `accessKey` placeholders in `browserstack-load.yml` as they are (the environment variables override them), and keep your access key out of every file you push. If a key is ever exposed, regenerate it from Account Settings.
 
 ## Running your tests