hide database credentials in file