Appsmith datasource secrets and browser variables have different boundaries

Appsmith's security documentation explains that datasource credentials are applied server-side. That does not make arbitrary values embedded in client-side JavaScript secret.

For the Appsmith integration, keep credentials in the supported datasource configuration and inspect a dummy application's browser requests. Also evaluate query parameterization separately: hiding a database password and preventing unsafe query construction solve different problems. Avoid placing production credentials in example bindings or screenshots.