Maybe you work for a company that leaves DB passwords in plaintext in configuration files on their servers. You would probably be among the majority. Or maybe your company encrypts passwords in configuration files: Also not that uncommon. What’s not common is having the devops team “transmit” the password to the application after it has already been started. It’s a reasonable requirement, but out of the box, Play 2.1 presents several hurdles.