Skip to content

Security: pouradba/dba-coworker

Security

SECURITY.md

Security Policy

Supported Versions

Version Supported
v17.x ✅ Current
< v17 ❌ Upgrade recommended

Dependency Security

DBA Coworker uses a minimal dependency footprint by design:

Layer Dependencies Count
Backend express, cors, pg 3
Frontend react, react-dom 2
Dev vite, @vitejs/plugin-react 2
Total Direct dependencies 7
  • No Axios — uses native fetch() API
  • No lodash, moment, or heavy utility libraries
  • All HTTP calls use Node.js/browser native fetch

Sensitive Files

The following files contain credentials and are excluded from version control via .gitignore:

  • backend/servers.json — database connection credentials
  • backend/api_key.json — Claude AI API key
  • backend/cdc_config.json — CDC pipeline configuration
  • backend/query_history.json — saved SQL queries

Never commit these files to Git.

Reporting a Vulnerability

If you discover a security vulnerability, please:

  1. Do NOT open a public GitHub issue
  2. Email the security team directly
  3. Include steps to reproduce
  4. Allow 48 hours for initial response

Security Best Practices

When deploying DBA Coworker:

  • Run on internal network only (not internet-facing)
  • Use PostgreSQL roles with minimum required privileges
  • Rotate database credentials regularly
  • Keep Node.js and npm packages updated
  • Review npm audit output before deploying

There aren't any published security advisories