Prompt MySQL root password only when you are running rake. This way, you can set minimum required MySQL privileges to 'app_user'.

database.yml

<%
  rake = File.split($0).last == 'rake'
  if rake
    begin
      STDOUT.puts "MySQL root Password:"
      password = STDIN.gets.strip.downcase
    end until password.length > 0
  end
%>

# SQLite version 3.x
#   gem install sqlite3
#
#   Ensure the SQLite 3 gem is defined in your Gemfile
#   gem 'sqlite3'
development:
  adapter: mysql2
  database: app_development
  username: <%=rake ? 'root' : 'app_user' %>
  password: <%=rake ? password : 'app_password' %>
  pool: 5
  timeout: 5000

# Warning: The database defined as "test" will be erased and
# re-generated from your development database when you run "rake".
# Do not set this db to the same as development or production.
test:
  adapter: mysql2
  database: app_test
  username: <%=rake ? 'root' : 'app_user' %>
  password: <%=rake ? password : 'app_password' %>
  pool: 5
  timeout: 5000

production:
  adapter: mysql2
  database: app_production
  username: <%=rake ? 'root' : 'app_user' %>
  password: <%=rake ? password : 'app_password' %>
  pool: 5
  timeout: 5000