This is not a bug, but rather you expecting it to do something it's not meant to do. The secret masking works only on fields and inputs marked as secret. If you enter a password into a plaintext field that's not marked as such, the engine is going to display it as a non-secret.

Even with "secret" fields be aware that:
1, they're not encrypted and are stored in the DB as plaintext fields. It's the API that's doing the masking. There's a PR to fix this
2, they can still be shown in the GUI if you click on the "Preview" button (I have a fix for this in my codebase, but can't bring myself to do a PR)
3, for python actions, even secrets are provided to the scripts as plaintext values and are capturable via "ps -ef | grep wrapper" if the action runs long enough, even by a non-admin user that has access to the system (or can execute ps -ef | grep wrapper via other means.

How do we mark something as a secret other than using "--encrypt" when we store it in the database? In my request I didn't type in the password in plain text, I referred to a key which was marked as a secret
https://:{{ st2kv.system.github_key | decrypt_kv }}@

Also, how come its masked in the CLI and API but not GUI.

Similar to API and log below
[api]
mask_secrets = True

[log]
mask_secrets = True

Maybe we can add a similar option to
[webui]
mask_secrets = True

In the yaml definition of the action. In this case you'd have to fork the st2_pack install action