Tim,
I looked at some of my files in a text editor that uses database connections around my company and mine didn't have credentials in the XML. I did some further digging and it seems like if you have a connection on the server and when adding it to your workflow you use that "Gallery" connection, it just puts the name of the connection in the XML.
If you manually configure the connection it places the Encoded password in the XML. I assume this "encoding" is probably pretty easy to reverse engineer. Doesn't look to be some sort of really sophisticated encryption.
My #1 recommendation would be to use server configuration for database connections and train users to not use local db connections for checked-in workflows.
The more complicated alternative would be to setup a pre-commit routine in GIT that would find and remove these passwords from the XML and then put them back when you run your production pipeline. So you could do something like find all XML in <password> brackets and replace with something like {PASSWORD REMOVED}. Then, assuming you are automating deployment with git, you could have it add that back to the XML before deployment.
Option 2 seems overly complicated to me, but might be helpful if you just want to wipe out those credentials because you have users that won't know any better. Using global pre-commit hook to prevent committing unwanted code | by Benoît Ripoche | Medium
