When restic repository uri contains a password then it'll show up in logs
The full restic command line is shown in tabacco agent logs, including user:password for http basic auth. A solution might be to set RESTIC_REPOSITORY in the environment instead, at the cost of making it slightly harder to reproduce the exact command being run