To be honest, it would be slightly better, if Lucee allowed the hash version of the password, to be used as:

this.webAdminPassword

At least, we could read this out of a file or just expose it directly. But, if a malicious user got hold of the hash, it still wouldn’t allow them to get into the Administrator UI.