The current version 1.5.2 of the SCP plugin hides the password during entry in
the user interface, but stores the password or passphrase in clear text in the
plugin configuration file. This is a security risk. The password should be
stored in an encrypted format and only decrypted when a file transfer is being
performed.