# In global or local git/config  (extra backslashes needed for git)
[filter "hide-password"]
clean = /usr/bin/perl -pe 's/^password\\s*=\\s*\\K.*/PASSWORD/'

# In repo/.gitattributes
settings.conf  filter=hide-password

# settings.conf
password=3zhGERnFhzaUVs
foo=bar
...