Denis

Security

What protects your account and your databases, stated plainly, and how to tell us when something is wrong.

Isolation

  • Every database is a separate project inside the engine with its own token. The platform is the engine's only client; the engine port is never reachable from the internet.
  • A request reaches a database only through the gateway, which checks who you are (session, database account or API key), what role you have, whether the key may write, and how much of the daily budget is left — on every request, from the database, never from a cached claim.
  • Roles are owner, admin, editor and viewer; the UI hides what the server refuses anyway.

Credentials

  • Passwords are hashed with scrypt (N=16384) and a per-account salt; the platform never sees or logs a plain password after sign-up.
  • API keys are shown once and stored as SHA-256 hashes. Keys can be read-only. Revoking a key also invalidates every access and refresh token issued from it.
  • Access tokens are HS256 JWTs that expire after 15 minutes; refresh tokens after 30 days; database-account sessions after 12 hours. Cookies are httpOnly, SameSite=Lax and secure.
  • Sign-in, database sign-in and token exchange are rate limited per address and per account, so a password cannot be guessed online.

Transport and browser

  • TLS 1.2+ with HSTS. Every response carries a Content Security Policy that only allows the site's own scripts and styles, forbids framing and plugins, and pins form targets to the site.
  • State-changing API requests from another origin are refused before any handler runs, and JSON bodies are required (no form-encoded or text/plain smuggling).
  • No third-party scripts, analytics or fonts are loaded.

Data

  • Every acknowledged write is appended to a journal and fsynced within one second; a snapshot replaces the journal every thirty seconds.
  • Quotas (storage, keys, commands) are enforced by the engine and the gateway so that one tenant cannot starve another.
  • Command history stores commands for 30 days for the database's own members; sign-in lines are redacted before they are stored.
  • You can export or delete everything from Settings at any time; see the Privacy Policy.

Operations

  • Production access is limited to the operator with hardware-backed keys. Secrets live in the environment, never in the repository.
  • Dependencies are updated through automated alerts; the engine and the platform are open source, so anyone can review what runs.
  • Backups are encrypted at rest and expire after 30 days.

Reporting a vulnerability

If you find a weakness, write to hacimertgokhan@gmail.com with the steps to reproduce it. We confirm receipt within two working days, keep you informed, credit you if you wish, and do not take legal action against good-faith research that:

  • only touches accounts and databases you created yourself;
  • does not degrade the service for others (no denial of service, no mass scanning, no spam);
  • does not access, change or delete other users' data — if you stumble on it, stop and report;
  • gives us a reasonable time to fix the issue before it is published.

Security-relevant changes are listed in the project's changelog.