Maybe this is a first step rather than using plain text password. Using a separate vault like subsystem would be more appropriate.