Secure your application
Keep database credentials on the server
Section titled “Keep database credentials on the server”Connect from your application backend. Do not embed an administrative database password in browser or mobile code. Use the minimum privileges your application needs.
Configure authentication and TLS
Section titled “Configure authentication and TLS”Use the authentication guide for settings supported by your release. A local --no-auth example is not a production configuration.
Bind listeners to the intended interface, and permit only the required networks. A console or metrics endpoint needs its own exposure review. Connection settings.
Isolate customer data
Section titled “Isolate customer data”Derive the account identity from an authenticated session. Apply that scope consistently to reads, writes, search and tool execution. Do not rely on an agent to add its own authorization filter.
Check the supported roles and isolation boundaries before sharing one database across customers.
Create a read-only application role
Section titled “Create a read-only application role”From an administrator connection, grant access to an existing table:
CREATE ROLE app_reader LOGIN PASSWORD 'replace-with-a-unique-password';GRANT SELECT ON work_items TO app_reader;Use a unique password managed outside source control. Reconnect as app_reader and run:
SELECT id, title FROM work_items;That role can read the granted table. An INSERT into the same table must fail with a permission error. Test both outcomes before using the account in an application. This example uses the table from relational data.
Redis key access currently requires a superuser role. A SQL table grant does not provide scoped Redis access. See Redis authentication before using Redis clients in a shared deployment.
Use parameters
Section titled “Use parameters”Use your client’s bound parameters for untrusted values. SQL identifiers such as table names require an allowlist; they are not ordinary value parameters.
Treat Particles as trusted code
Section titled “Treat Particles as trusted code”Deploy only reviewed code and dependencies. Runtime limits do not automatically provide a security sandbox. Read Particles limits and trust before allowing other users to deploy functions.