Security

The supported runtime permits configured sources, bounded paging, validated geometry/CRS and a restricted filter grammar. Paths, filter literals and geometry are bound parameters; identifiers come from source configuration/discovered schemas and are safely quoted. Clients cannot send raw SQL or load extensions.

Production/non-loopback diagnostic access requires CDF_API_TOKEN. Generate at least 32 random bytes, store the token in a secret manager, send a Bearer header over TLS, and rotate through secret updates plus restart. Comparison is constant-time. One token grants all configured source/metrics access; there are no user roles or per-source scopes.

Health probes expose status only. HTTP native errors and core telemetry do not disclose SQL/source details. Trusted CLI error output may contain source locations; restrict/redact it.

Operational controls

• Keep configuration/source paths/remote hosts operator-controlled.
• Use read-only source credentials and approved egress, including redirects/DNS.
• Preinstall official extensions and disable runtime installation. CloudFS requires a separately reviewed signed community build; verify its exact extension revision before injecting credentials.
• Use non-root/read-only deployments and bounded scratch/memory resources.
• Apply TLS, rate/connection limits, and network policy at the platform boundary.
• Separate configurations/instances for separate trust domains.
• Pin image digests and scan dependencies, native extensions, and images.

The ArcGIS model relies on service authorization and does not filter by forwarded user identity. A service must only include sources its audience may access.

CloudFS boundary

CloudFS is opt-in and cannot currently activate on the pinned DuckDB 1.5.6 because the community binary is unavailable. Do not downgrade or bypass signature/version checks. Credentials use environment references and temporary secrets; no SQL/secret inspection endpoint is exposed. Upstream secret redaction and process-global authentication require dedicated worker isolation. Non-loopback agents require vfs+tls, which is blocked for build 4ca1432 pending a routing fix; SFTP is rejected because the reviewed code lacks host-key verification. See CloudFS review and qualification.

Experimental boundary

src/experimental is excluded from npm/container artifacts. It does not provide certified JWT/RBAC, tenant isolation, RLS, plugin sandboxing, or streaming authorization. Built-in demo accounts were removed; credential lookup fails unless an explicit verifier is supplied. Remaining prototype security behavior needs design/testing.

Historical copied samples/configs in docs are not production guidance. Do not deploy their default account examples, SQL templates, broad MCP allowlists, or infrastructure scripts.

Report vulnerabilities privately to repository maintainers through your organization's reporting channel, with revision, reproduction, and impact but no secrets. No verified contact address is declared by this repository. See review report. P1 source/schema identities are checked before serving cached data. HTTPS identity checks require public strong ETags and reject redirects; they do not inherit native secrets. Pool workers isolate native interruption; CloudFS credentials remain process-scoped and require one worker. Review P1 limits before activation.