Security Overview
Security best practices and guidelines for Lordbase.
Security Features
Lordbase includes built-in security features:
| Feature | Description |
|---|---|
| Encrypted Credentials | Database passwords are encrypted at rest |
| Connection Pooling | PgBouncer isolates client connections |
| Rate Limiting | Protection against abuse and brute force |
| HTTPS Only | All API and Dashboard traffic is encrypted |
| CORS Protection | Cross-origin request validation |
| Audit Logging | Complete trail of all actions |
| Developer Access Tokens | Scoped, expirable API tokens |
| Role-Based Access | Workspace and database-level permissions |
Documentation
| Section | Description |
|---|---|
| Best Practices | Security recommendations |
Security Architecture
Authentication Methods
| Method | Use Case | Security Level |
|---|---|---|
| Session Cookie | Dashboard access | High (HttpOnly, Secure, SameSite) |
| JWT Bearer Token | Service-to-service | High (signed, expirable) |
| Developer Access Token | Programmatic API access | High (bcrypt hashed, scoped) |
Reporting Security Issues
If you discover a security vulnerability:
- Do NOT disclose publicly
- Email [email protected]
- Include detailed description
- We will respond within 48 hours
Next Steps
Start with Security Best Practices.