What the ArcadeDB server enforces, how to configure it for production, and how the open-source project keeps its code and dependencies trustworthy.
ArcadeDB enforces security at the server level. In embedded mode there is no security unless you run the server security or provide your own, so an embedded application owns its access control.
HTTP Basic authentication, plus token-based login with explicit logout and session expiry. Since 26.9.1, deleting a user or changing a password revokes that user's tokens immediately on every node. See HTTP API.
Passwords are stored hashed with PBKDF2 (HMAC-SHA256). The default policy requires 8 to 256 characters and can be replaced with your own validator. In a cluster, user changes replicate to every server. See Users.
Per-database groups grant create, read, update and delete per type, plus schema, security and settings rights. Groups can cap query time (readTimeout) and result size (resultSetLimit). See Groups.
With arcadedb.ssl.enabled=true the server opens an HTTPS listener (default port 2490). Bolt supports bolt+s, the PostgreSQL wire protocol gained TLS in 26.10.1, and the Raft gRPC transport between nodes can use mutual TLS. See HA configuration.
The root password (rootPasswordPath) and the HA cluster token (clusterTokenPath) can be read from mounted files, so they never appear on the command line. Production mode logs a checklist of security-relevant settings at startup. See Handling secrets.
Report vulnerabilities privately through GitHub Security Advisories or [email protected]. The security policy commits to acknowledging within 3 business days, and fixes are published as advisories.
main, and the run history is public, including the failures.reuse lint makes a file without copyright and license information fail the pull request that adds it.Report it privately, never in a public issue. We acknowledge reports within 3 business days.
Do not open a public issue. Use a private GitHub Security Advisory on the ArcadeData/arcadedb repository, or email [email protected]. The security policy commits to acknowledging reports within 3 business days and publishes fixed issues as GitHub Security Advisories.
No. ArcadeDB enforces authentication and permissions at the server level. An application that embeds the engine runs without security unless it starts the server security or provides its own access control.
Yes. With arcadedb.ssl.enabled=true the server opens an HTTPS listener (default port 2490). Bolt supports bolt+s, the PostgreSQL wire protocol gained TLS in 26.10.1, and the Raft gRPC transport between cluster nodes can use mutual TLS.