Only the latest release receives security fixes.

Please do not open a public issue for a security vulnerability.

Report it through GitHub's private vulnerability reporting, which is the preferred channel:

https://github.com/deniscuciuc/db-analyzer-postgres/security/advisories/new

If you cannot use GitHub, email denis.cuciuc@zelqonworks.com instead.

Please include a description and impact, steps to reproduce, the affected version, and any suggested mitigation.

Please give us a reasonable opportunity to release a fix before disclosing publicly. We will credit you in the advisory and the changelog unless you prefer otherwise.

This tool connects to a PostgreSQL server with credentials you supply and can, for some commands, change server state. In scope:

• Anything that could execute unintended commands against your database
• Credential handling, including anything that could write a password to a log, a report or the terminal
• Anything that could cause a destructive command to run without the confirmation it requires
• Output escaping in the generated HTML reports

Out of scope: vulnerabilities in PostgreSQL itself or in its client library — report those upstream, though we would still like to know so we can pin or work around an affected version.

• Prefer a read-only role. Only the run-vacuum-style commands and the profiler and extension commands need write access, and those require --yes.
• Passing a password on the command line puts it in your shell history and in ps output. Prefer the environment variables documented in the README, or a .analyzerrc.json profile with restrictive file permissions.
• .analyzerrc.json may contain credentials. It is listed in .gitignore, but that is the only thing protecting it — do not commit it.