Access-list item passwords were stored and returned in plaintext. Hash on write with bcrypt, compare hashes in the proxy engine (with legacy plaintext fallback), and omit passwords from admin GET JSON.