Now that you hide password values on this screen, it is hard to track what the value is represented by the variable. A description field would be useful to document setting or usage. Another alternative would be to allow at least the system admin to see the real value.

Part of the problem is that is that you don't allow composite (recursive) global variables so that one variable cannot reference another variable. So, in many cases a password needs to be embedded in a longer substitution variable (and have a name that contains password) to get the hiding in the build log. But then the entire value is not visible and needs to be reconstructed to make any changes.