Bro, what I said is that an attacker who someways get access to production, can push modified source code that send cleartext password to him before everything else.