Credentials
Where a database's password is, who can read it, and how to rotate it.
cubeship db credentials pgPrints the username, the password, the database name and both connection strings. It requires permission to read database secrets and uses its own endpoint — never a listing — and the database's Overview shows the same behind a reveal.
Stored as given
The password is stored as it was chosen or generated, not hashed: a hash
cannot connect to anything, and every attached app needs the real one in
its environment. It is also in the container's own configuration, which
docker inspect on the host reads.
Generated unless chosen
A request with no password gets 24 generated characters, so a database with a weak one is not something anybody gets by leaving a box empty. The dashboard generates its own and shows it.
Rotation
Use Rotate credentials in the database's settings while it is running. Cubeship changes the engine password before saving the new value. The old password stops working immediately; update external clients, and redeploy attached apps so they receive the new value. Rotation requires database manage access and permission to read its secrets.
Never through an agent
No MCP tool reads or sets a password. An agent can provision a database and attach an app, and the app receives the credential through its environment without the agent ever holding it.