¶Security

ElyraSQL Client is designed so that your data and credentials stay under your control.

¶Credentials

• Connection passwords are stored in the OS keychain — macOS Keychain, Windows Credential Manager, or the Linux Secret Service — and are never written to disk in cleartext.
• Removing a connection also deletes its keychain entry.

¶Where queries run

• Queries execute in the Rust core; the UI (webview) only receives results.
• The core reads credentials from the keychain and opens connections on demand.

¶How writes are authorized

Every mutating operation goes through a single choke point in the connection broker. A write cannot execute without a write authorization, and obtaining one is the only place the policy is checked:

• read-only connections are refused outright;
• production connections require an explicit confirmation, which the app asks for and then retries with.

Because the authorization is required by the type system, a newly added feature cannot accidentally bypass the rails — it won't compile without one. Server commands that don't touch user data (BACKUP TO, KILL) are the only documented exceptions.

¶Correct SQL quoting

All SQL is generated through one central, engine-aware quoting layer, so identifiers and values are escaped per dialect (MySQL/ElyraSQL processes backslash escapes in strings; SQLite does not). Values are always quoted — never inlined as bare numbers — so text like 007 cannot be altered in transit. This layer is unit-tested, including LIKE metacharacter escaping.

¶Safety rails

• Destructive actions preview their SQL (inline edits, table designer, truncate/drop) and require confirmation before running.
• Read-only connections refuse writes and DDL.
• Production connections require an explicit confirmation for writes and draw a red window frame.
• The client only ever narrows access — the server's own privileges always apply.

¶Transport

• TLS is used opportunistically and can be required per connection. Require TLS is enabled automatically for any non-local host, so a connection that leaves your machine is encrypted by default (you can still override it).
• The app reports the actual transport state, asked of the server rather than inferred from your settings: an encrypted session shows a 🔒, and a remote connection carrying data in clear text is flagged ⚠ unencrypted in the toolbar and in the Test connection result.
• SQLite connections are local files with no network transport, so they are never flagged.

¶Licensing privacy

License validation sends only your key, the app name/version and an opaque per-install id to elyracode.com. No database contents are transmitted. See Editions & Licensing.

¶Reporting a vulnerability

Please report privately — see the repository's SECURITY.md. Do not open a public issue for security reports.