# Sqlcmd hardener

Run `av harden sqlcmd` to apply this hardener and `av doctor sqlcmd` to verify it.

The sqlcmd Hardener installs the reviewed, Developer ID-signed sqlcmd Isotope
and moves supported basic-auth passwords from `~/.sqlcmd/sqlconfig` into
Automic Vault custody. The config retains only user, context, endpoint, and
`@av` marker metadata.

Password reads are bound to the verified sqlcmd Target, selected user profile,
endpoint, and complete command. Password creation and deletion use separate
approved mutation operations. Custom sqlconfig paths, unsupported
authentication, malformed markers, and missing Secret Values fail closed.

Legacy sqlcmd flags, `SQLCMD_PASSWORD`, `SQLCMDPASSWORD`, certificates, and
credentials supplied outside the default modern sqlconfig remain outside this
Hardener's coverage.