I think even better to encrypt the password in ~/.authinfo.gpg, e.g.,

     machine my_db login my_usr password bla-bla-123

And then in the source block header, you can inject it into a variable

    :var pass=(auth-source-pick-first-password :host "my_db")

That's a built-in elisp function. Yes, you can call arbitrary functions to assign vars for org-mode source blocks. You can even assign shell command output, I often do things like:

    :var token=(shell-command-to-string "echo $MY_TOKEN")

What's crazy about this shit is that you can even pipe the content of the file back into itself:

     #+begin_src sh :pretty :var token=(shell-command-to-string (format "grep my_token %s" buffer-file-name))
        echo $token
     #+end_src
     

That's an absurd bananas degree of ingenious engineering that makes you question the sanity of programmers who deliberately abandon Emacs, even after experiencing such power.