ObjectDB Explorer Exposes Username and Password

How can I prevent my embedded database's username and password from being exposed by ObjectDB Explorer?

See url-history setting and the user and password attributes.

If I understand correctly, if someone were to remove the configuration file, the username and password would again be exposed. My ultimate question is, under any circumstances, how do I prevent anyone from accessing my embedded database without knowing the username and password?

Note that the username and password are for client-server mode. In embedded mode databases are accessible with no username and password.