Hiding or encrypting SMTP password required in app.yml

It’s available only to people with root access to the server. If you don’t trust people who have root access to your server, then you have more profound problems than worrying about whether they have access to an SMTP password.