Just to add for anyone who winds up here from a search, you can specify the -I option when running fab for it to prompt you for a default password to use. This way it won't be visible in your command history
example:
$ fab -I my_task
Initial value for env.password: