Currently defaults/flow_cred.json get pushed to cloudant as-is without considering how to decrypt it.
This actually doesn't work because credential secret (used to decrypt flow_cred.json) is randomly generated unless you explicitly define it in node-red settings (bluemix-settings.js).
Ideally, defaults/flow_cred.json should support decrypted version of credential file.