Having the clear text on Developer Console is not an issue, it's part of how the browser works. TLS is designed to protect data between when it leaves your computer and reaches the end server. It's not to protect against hardware keyloggers, rubber-rose cryptanalysis, or developer consoles.
But I've received a concern asking "malicious user succeeds in session hijacking in someway will be able to access the end user credentials". Is this a valid argument? if so, how can I act?
If this is the concern, you must look somewhere else. The issue is not with TLS at all, the issue is at the application level, or database.
Do your application have any anti-XSS (cross site scripting) and anti-CSRF (Cross Site Request Forgery) protections in place? If not, an attacker may inject script on a client (XSS) or trick a client into accessing a crafted page while logged into your application (CSRF) and execute code as the user.
How are your application managing user input that is fed to databases? Is the application preventing SQL Injection? If not, an attacker may execute SQL on your database and leak data, specially passwords.
If the entire site is served over TLS, you don't have to care about that part. You need to make sure the application follows secure coding standards. That's what you can do. On the TLS side, it does not hurt to test the cyphers and modes enabled. SSL Labs have a good one.