How are passwords protected?

Passwords shouldn't be stored in plain text. Application accounts use robust hashing functions with salt, controls against repeated attempts, and secure reset procedures. Credentials for external services are treated as secrets and are not placed directly in the source code.