Javascript remove password value from JSON string [duplicate]

Consider the following JSON string:

{
  "serverURL": "http://example.com/api",
  "security": {
    "username": "foo",
    "password": "mypassword"
  }
}

How to use regex to replace the value of password to ‘XXXXXXXX’?

Please note that password may contain whitespace and/or any punctuations, and there may or may not be a comma after “mypassword”.