Currently the ModeShape kit for Wildfly/EAP includes a "standalone-modeshape.xml configuration file that sets up the ModeShape subsystem that uses a custom "modeshape-security" security domain configured with "modeshape-users.properties and modeshape-roles.properties files. These are not password-protected, and instead of these files ModeShape should just use the already-existing "ApplicationRealm" security realm (with "other" security domain) so that users can be added via the command line tool and passwords will be encrypted.