Recommendations for securing your Lordbase databases and API access.
Credential Management
| Practice | Description |
|---|
| Use environment variables | Never hardcode passwords or tokens in source code |
| Rotate credentials | Periodically reset database user passwords |
| Least privilege | Grant minimum required permissions to database users |
| One credential per service | Use separate database users for each application |
Database User Security
Permission Levels
- Use Read Only for analytics, reporting, and dashboards
- Use Read/Write for application services that modify data
- Use Admin only for migration scripts and trusted admin tools
Password Management
- Reset passwords immediately if a credential is compromised
- Use strong, auto-generated passwords (Lordbase generates these by default)
- Never share admin credentials with team members — create individual accounts
Developer Access Token Security
| Practice | Description |
|---|
| Set expiration dates | Use expires_in_days when creating tokens |
| Use minimum scopes | Only grant the permissions your automation needs |
| Revoke immediately | Revoke tokens when no longer needed or if compromised |
| Never commit to git | Add tokens to .gitignore and use CI/CD secret management |
| Monitor usage | Review last_used_at and last_used_ip regularly |
Network Security
| Practice | Description |
|---|
| Always use SSL | Connect with sslmode=require for production databases |
| Use PgBouncer | Connect via port 6432 for pooled, isolated connections |
| Limit connections | Set appropriate max_connections for your plan |
Workspace Security
| Practice | Description |
|---|
| Separate environments | Use different workspaces for dev, staging, and production |
| Review membership | Regularly audit who has access to each workspace |
| Remove inactive members | Revoke access for former team members |
| Use descriptive names | Clearly label workspaces to avoid accidental operations |
Backup Security
| Practice | Description |
|---|
| Regular backups | Configure scheduled backups for all production databases |
| Test restores | Periodically verify that backups can be restored successfully |
| Monitor failures | Set up alerts for failed backup schedules |
| Retention policies | Balance data safety with storage optimization |
Monitoring & Auditing
- Enable and regularly review Audit Logs for all databases
- Monitor slow queries and optimize them proactively
- Track cache hit ratio — target above 95%
- Review active connections to detect unusual patterns
Next Steps