For anything using libpq a .pgpase file can help separate creds in source/conf from now machine level ACLS.