The ordinary SMTP path, for applications that do not run on Microsoft 365: a hosting provider’s mailbox, a relay, or your own server. The account stays the customer’s, and the platform holds the password and injects it at deploy time, so it never reaches the repository. Use the library your language already has, whether that’s nodemailer, smtplib, or whatever is idiomatic, and read SMTP_SECURE as a string: implicit TLS on port 465, STARTTLS everywhere else. Outbound SMTP is closed until the grant exists: an application without an SMTP connection for that environment cannot reach ports 25, 465 or 587 on any outside server, so a pasted password goes nowhere. The rule is reapplied on every deploy, and a grant takes effect with the next one. HTTPS mail APIs are not affected.
SMTP's own documentation →SMTP_HOSTSMTP_PORTSMTP_SECURESMTP_USERSMTP_PASSMAIL_FROM