At the moment, password entered in startup script and user_group_sync.sh is in plain text. There is no way/tool to mask/encrypt it. This is likely breaching security policy in certain organizations.