It would be great if the functionality added in #45 for password and username could also include homeserver to help prevent leaking the homeserver URL:

my.homeserver = "${sec.data.my-homeserver}"

related: #44