Credential handling by transport
Managed direct and SSH
dbtempo stores the database username and encrypted password so its managed runner can reach the database directly or through the selected SSH host.
CLI daemon
The local agent reads database credentials from its configuration. Those database credentials stay inside your environment and are not sent with analysis payloads.
Analysis data
Analysis can use query statistics, example query text, schemas, indexes, execution plans, database configuration, and source snippets when source analysis is enabled. Raw table rows are not part of the collection payload.
Paste mode sends the SQL or database artifact you submit through the analysis pipeline. Do not paste secrets or row data into a thread.