A password opens the whole hosting account to whoever holds it, so the SyncNow operating policy, which every agent must acknowledge, forbids direct FTP, SFTP, SSH or SQL connections and sends every operation through the SyncNow tools.
The hosting and database passwords are kept in the vault of the SyncNow server, which uses them to run the agent's operations. They are never shown to an agent or through an agent session: in Connections the hosting password appears as Stored securely, and the server shows a stored password only to the project owner or a manager, in the SyncNow app, after a one-time code sent to the account email. Secrets that SyncNow recognizes inside project files, such as a database password in a configuration file, reach the agent as placeholders beginning with __SYNCNOW_SECRET_, and the server puts the real values back when the agent writes the file.
A placeholder works only in the file it came from: writing it into another file is refused. What the agent gets instead of a password is explained in What does my agent get instead of a password?.