Credentials

No password in argv, ever. There is no --password. A password in a process list, a shell history, or a CI transcript is precisely the failure the credential-store design exists to prevent.

sqlmc reads the same DPAPI-backed store the desktop app writes to. A password you saved in the app is usable from the command line as the same Windows user on the same machine, and nowhere else — DPAPI scopes it that way and that is the point.

A build agent running as a service account therefore sees none of your saved credentials. Today that means the agent can only reach connections that use integrated authentication as the service account, or a server that needs no secret.

Planned — not implemented. SQLMC_SECRET_* environment variables exist in the design for exactly the service-account case, and are named in a source comment and in the project's own skill documentation. Nothing reads them today. Do not write a pipeline that depends on them.