Did you know…
That if you have the debug mode set to ON for your server actions, then in certain circumstances your database password is revealed in the Chrome Networking Console?
So the first point is to make sure it is switched off most of the time!
And the request is for there to be a big bright banner at the top of the Server Action window when debug mode is set ON, which includes a warning that it is a security risk.
I had forgotten the debug mode switch was there and would have happily gone into production without realising!