# Secure your application

Protect credentials, scope application access, and understand the trust boundary of code executed by ParticleDB.

Source: https://particledb.ai/guides/security/

## Keep database credentials on the server

Connect from your application backend. Do not embed an administrative database password in browser or mobile code. Use the minimum privileges your application needs.

## Configure authentication and TLS

Use the [authentication guide](/connectivity/tls/) for settings supported by your release. A local `--no-auth` example is not a production configuration.

Bind listeners to the intended interface, and permit only the required networks. A console or metrics endpoint needs its own exposure review. [Connection settings](/installation/ports/).

## Isolate customer data

Derive the account identity from an authenticated session. Apply that scope consistently to reads, writes, search and tool execution. Do not rely on an agent to add its own authorization filter.

Check the supported [roles and isolation boundaries](/architecture/multi-tenant/) before sharing one database across customers.

## Create a read-only application role

From an administrator connection, grant access to an existing table:

```sql
CREATE ROLE app_reader LOGIN PASSWORD 'replace-with-a-unique-password';
GRANT SELECT ON work_items TO app_reader;
```

Use a unique password managed outside source control. Reconnect as `app_reader` and run:

```sql
SELECT id, title FROM work_items;
```

That role can read the granted table. An `INSERT` into the same table must fail with a permission error. Test both outcomes before using the account in an application. This example uses the table from [relational data](/guides/relational-data/).

Redis key access currently requires a superuser role. A SQL table grant does not provide scoped Redis access. See [Redis authentication](/redis/overview/#authentication) before using Redis clients in a shared deployment.

## Use parameters

Use your client's bound parameters for untrusted values. SQL identifiers such as table names require an allowlist; they are not ordinary value parameters.

## Treat Particles as trusted code

Deploy only reviewed code and dependencies. Runtime limits do not automatically provide a security sandbox. Read [Particles limits and trust](/particles/limits/) before allowing other users to deploy functions.

## Related

[Documentation home](/docs/) · [Troubleshooting](/guides/troubleshooting/)