Security
How to report a vulnerability, and what GraphBuff does to protect the data it holds.
Report a vulnerability
Report it privately through GitHub: open a security advisory on the engine repository. Please do not open a public issue for a vulnerability.
Affected version or commit:
What an attacker can do:
Steps to reproduce:
Configuration (storage mode, --token or --users, TLS on or off):Fixes land on the main branch; no release has been tagged yet, so there are no older versions to patch. There is no bug bounty.
What is built in
- Local by default
- The server listens on 127.0.0.1 unless you bind it elsewhere.
- Authentication
- A bearer token, or a users file with PBKDF2-HMAC-SHA-256 password hashes (600,000 rounds, random salts). Without either, any credentials pass: set one before you bind to a public address.
- Roles
- reader, editor and admin, checked for every statement. A role granted or revoked applies to open connections at once.
- TLS
- HTTPS and Bolt over TLS 1.3 and 1.2 on the same ports, through rustls. An optional build feature.
- File access
- LOAD CSV reads only files inside the import directory.
- Backups
- Written while queries keep running; restore and consistency checks from the command line or over HTTP for administrators.
Details: Users and TLS and Backup in the documentation.
What is not there
Custom roles and fine-grained privileges, suspended users, audit logging and encryption of data at rest are not implemented. GraphBuff has not had an independent security audit.