Are there credentials committed to source code repository? If not, how are credentials (e.g. db connection strings, API access etc.) managed/stored/retrieved?

No Credentials committed to Source code repository. Access to the Database is provided through Data Source connectivity - Unlike WordPress, no DB credentials stored anywhere in the source code.