diff --git a/server/api/config/global.put.ts b/server/api/config/global.put.ts
index ce392ac..32d8078 100644
--- a/server/api/config/global.put.ts
+++ b/server/api/config/global.put.ts
@@ -12,6 +12,13 @@ type UpdateGlobalConfigBody = {
     value: unknown;
 };
 
+function toSafeResponseValue(key: string, value: unknown) {
+    if (key === "commentSmtpPass") {
+        return "";
+    }
+    return value;
+}
+
 export default defineWrappedResponseHandler(async (event) => {
     try {
         await requireAdmin(event);
@@ -23,7 +30,7 @@ export default defineWrappedResponseHandler(async (event) => {
         const value = await event.context.config.getGlobal(key);
         return R.success({
             key,
-            value,
+            value: toSafeResponseValue(key, value),
         });
     } catch (err) {
         throw toPublicConfigError(err);