@anthracite stored in plaintext but transferred over https between instances, this means anyone with *server* (not just admin) access on either of the participating instances could read them