It is in plaintext, but protected by TCC (so, only privileged apps / trusted by you can). Not sure about persistence. I believe it is rewritten periodically, possibly ignoring your edits