buildpack: fix password injection