use real class, not class in which method is defined
add fix in changelog
ensure all keys which end on password are stored as secure string