JGit over HTTPS with the password or access token off the heap: JGit holds a placeholder, and seclume's TLS writes the real credential into the Basic login from native memory.