Credentials are stored as-is in the database. In a production deployment, secrets at rest should be encrypted (see ADR 0007). For now keep this instance behind a private network.