This seems like the sort of problem that typed programming can vastly reduce. In a language where string representation is controlled by the data type itself, o

This seems like the sort of problem that typed programming can vastly reduce. In a language where string representation is controlled by the data type itself, one could protect against emitting passwords in plaintext accidentally. You'd still be vulnerable until deserialization happens, but that's a lot less surface area to worry about.