Right, so this "vault" design is built into the paid tiers of ClearML to achieve exactly that. Long story short, users can put their credentials/configs on the clearml-server and the agent (or the clients) will pull and merge them into the execution.
It's very cool and works really nice, but not part of the open source (or the SaaS tier).
What you could do is store these configurations on the Task itself (one way o r another). Maybe for example have an empty definitions.py file part of the git repository, and then the local changes (i.e. the users credentials) are stored as part pf the uncommitted changes section. This would mean that the agent will replicate the same user's definitions/py into the remote machine, and pass the credentials.
wdyt?