Operator JWT
Control-plane Bearer tokens from POST /api/login. Dashboard and lifecycle APIs sit behind them. HTTP /t/{id}/query is operator tooling, not the public tenant API.
What is true in the binary
Isolation is a kernel boundary. Auth is hashed.
Security page for diligence, not a compliance badge wall. We are not SOC 2 certified. If your questionnaire needs that line, say so — do not infer it from this site.
Intended inbox: hello@dbxdb.io / security@dbxdb.io. dbxdb.io has no MX yet, so those addresses do not receive mail. Do not file security reports as public GitHub issues. Preferred language: English. See also security.txt.
Tenant keys
256-bit secrets, stored only as hashes. Create, list metadata, revoke immediately — including live RESP connections. Secrets are never returned after mint. A reader key can GET and VSEARCH and cannot SET or VADD. Mint from Tenant keys in the dashboard.
Roles and scopes
reader, writer, and tenant-admin, with optional key-pattern scopes. AUTH is tenantID:keyID plus secret. The key is re-resolved on every command.
Login lockout
Per-IP brute-force protection on /api/login: five failures, sixty-second lockout. Admin passwords are bcrypt, never plaintext.
WAL integrity
Length-framed, sequenced, CRC-protected state-image transactions. CRC corruption is fatal. Checkpoints are sequence-bearing KV snapshots.
Backup checksums
A maintenance lock writes a versioned SHA-256 manifest for KV and vector files. Restore validates into a sibling directory and swaps with rollback.
TLS
Control plane TLS by default. -insecure-http is local development only. RESP ingress can require mTLS when configured.
Prometheus
Orchestrator GET /metrics is open only with -insecure-http. In production scrape with Authorization: Bearer — operator JWT or DBX_INTERNAL_API_TOKEN. Do not expose :8000 to the internet without TLS.
Blast radius
Provision, backup, restore, and purge operate on one tenant directory. There is no cluster-wide keyscan to “delete my data.”
v1 is a single-node profile. Raft and cluster mode fail closed. Optional async WAL replicas ack on the primary; replica lag is possible. Details in architecture.