If an error occurs during connection, the exception thrown includes the entire hosts list, which in turn may have passwords and those passwords will be present in the stacktrace.
(fn [e s]
(throw
(ex-info
(str "Failed to connect "
(.getUserName s) "@"
(.getHost s) ":"
(.getPort s)
" " (pr-str (into [] (.getIdentityNames agent)))
" " (pr-str hosts))
{:hosts hosts}
e)))
The password could be removed from the exception message and data.