The password should be stored as a Secret instead of a string, so that it gets encrypted when stored on disk.
I should have done that for gerritAuthKeyFilePassword a long time ago, but always forget to do so.