MongoDB through the official Java driver (mongodb-driver-sync) with the password off the heap: a pre-authenticated socket factory that opens the connection, speaks seclume's own TLS 1.3, and authenticates with SCRAM-SHA-256 computed entirely in native memory, before the driver gets the socket. The client library is given no credential and never holds the password.