Remove empty-password default access ​

The local installation sample declares a default user with an empty password. It is an explicit configuration entry, not an account the server generates. To stop using it, configure the named credentials your clients will use, update those clients, and remove the old entry from users.xml.

<coordinator>
    <users>
        <analyst>
            <password>replace-with-your-password</password>
        </analyst>
    </users>
</coordinator>

Use this only as a structural example; choose the actual secret outside shared documentation. A user may instead have a 64-character password_sha256_hex digest. Do not declare both password forms for the same user.

Restart the server to apply user changes, then test a connection with the intended username and credentials. Native client usernames default to default, so callers must select the replacement explicitly. HTTP requests without Authorization attempt the configured default user with an empty password; removing that account prevents this fallback from granting access.

Also test an unauthenticated SQL request. A successful unauthenticated /ping is expected and does not demonstrate SQL access. Preserve a working administrator-controlled configuration while making the change.

See users_config, native client options and HTTP authentication.