Is my SMTP password stored securely?

It's encrypted at rest in the database, not stored in plain text. Since this is self-hosted, the encryption key itself lives in your own server's environment configuration rather than anywhere we control remotely — so it's on your server's disk security to keep that environment file itself protected (standard file permissions, not committed to version control, etc.), same as any other secret your server holds.