Security Features and Architecture

<h2 id="security-features-and-architecture-in-geode" class="position-relative d-flex align-items-center group"> Security Features and Architecture in Geode <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-features-and-architecture-in-geode" aria-haspopup="dialog" aria-label="Share link: Security Features and Architecture in Geode"> Share link </button> </h2><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Security is foundational to Geode’s design, not an afterthought. Geode implements defense-in-depth security with multiple layers of protection, from mandatory network encryption to fine-grained data access controls. This zero-trust architecture makes Geode suitable for regulated industries including healthcare, finance, and government. <h3 id="introduction-to-database-security" class="position-relative d-flex align-items-center group"> Introduction to Database Security <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="introduction-to-database-security" aria-haspopup="dialog" aria-label="Share link: Introduction to Database Security"> Share link </button> </h3>Modern database security requires protection across multiple dimensions: Network Security: Encrypt data in transit, prevent eavesdropping Authentication: Verify user identity before granting access Authorization: Control what authenticated users can access Data Encryption: Protect data at rest from unauthorized access Audit Logging: Track access for compliance and forensics Data Integrity: Prevent unauthorized modifications Traditional databases often make security optional or add it as an afterthought. Geode makes security mandatory and deeply integrated. <h3 id="geodes-security-architecture" class="position-relative d-flex align-items-center group"> Geode&rsquo;s Security Architecture <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="geodes-security-architecture" aria-haspopup="dialog" aria-label="Share link: Geodes Security Architecture"> Share link </button> </h3> <h4 id="mandatory-tls-13-encryption" class="position-relative d-flex align-items-center group"> Mandatory TLS 1.3 Encryption <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="mandatory-tls-13-encryption" aria-haspopup="dialog" aria-label="Share link: Mandatory TLS 1.3 Encryption"> Share link </button> </h4>Geode requires TLS 1.3 for all network connections with no plaintext fallback: Why TLS 1.3: <ul> <li>Strong cipher suites only: No legacy weak ciphers (AES-GCM, ChaCha20)</li> <li>Forward secrecy: Past sessions remain secure if keys are compromised</li> <li>Faster handshake: 0-RTT resumption for returning clients</li> <li>Simplified configuration: Removes insecure options</li> </ul> Server configuration: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate self-signed certificate (development) openssl req -x509 -newkey rsa:4096 -nodes \ -keyout server-key.pem -out server-cert.pem -days 365 \ -subj "/CN=localhost" # Start server with TLS geode serve --listen 0.0.0.0:3141 \ --tls-cert=server-cert.pem \ --tls-key=server-key.pem </code></pre></div>Client connection (Python): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">from geode_client import Client # Production: Verify server certificate client = Client( host="geodedb.example.com", port=3141, ca_cert="/path/to/ca-bundle.crt" ) async with client.connection() as conn: result, _ = await conn.query("MATCH (n:User) RETURN count(n) AS total") # Development: Self-signed certificate client = Client( host="localhost", port=3141, skip_verify=True # Skip verification (dev only!) ) async with client.connection() as conn: result, _ = await conn.query("MATCH (n:User) RETURN count(n) AS total") </code></pre></div>Certificate management best practices: <ul> <li>Use Let’s Encrypt for public-facing servers (free, automated)</li> <li>Use internal CA for private networks</li> <li>Rotate certificates before expiration (automate with certbot)</li> <li>Store private keys securely (never in version control)</li> </ul> <h4 id="authentication" class="position-relative d-flex align-items-center group"> Authentication <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authentication" aria-haspopup="dialog" aria-label="Share link: Authentication"> Share link </button> </h4>Geode supports multiple authentication mechanisms: Built-in Username/Password: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create user with password CREATE USER alice PASSWORD 'secure_password_here' REQUIRE SECURE TRANSPORT; -- User connects with credentials -- (Credentials sent over TLS-encrypted connection) </code></pre></div>Python client authentication: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">from geode_client import AuthClient, Client client = Client(host="localhost", port=3141) async with client.connection() as conn: auth = AuthClient(conn) await auth.login("alice", "secure_password_here") result, _ = await conn.query("MATCH (n:Node) RETURN n") </code></pre></div>Password hashing (server-side): <ul> <li>Uses Argon2id (winner of Password Hashing Competition)</li> <li>Configurable time cost, memory cost, parallelism</li> <li>Resistant to GPU/ASIC attacks</li> <li>Automatically salted</li> </ul> Certificate-Based Authentication (mTLS): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Server requires client certificates geode serve --listen 0.0.0.0:3141 \ --tls-cert=server-cert.pem \ --tls-key=server-key.pem \ --tls-client-auth=required \ --tls-ca-file=client-ca.pem </code></pre></div><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"># Client provides certificate client = Client( host="localhost", port=3141, ca_cert="/path/to/ca.pem", client_cert="/path/to/client-cert.pem", client_key="/path/to/client-key.pem" ) async with client.connection() as conn: result, _ = await conn.query("MATCH (n:Node) RETURN n") </code></pre></div>LDAP/Active Directory Integration (Enterprise): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Configure LDAP authentication geode serve --listen 0.0.0.0:3141 \ --auth-method=ldap \ --ldap-url="ldaps://ldap.example.com:636" \ --ldap-bind-dn="cn=geode,ou=services,dc=example,dc=com" \ --ldap-bind-password="service_password" \ --ldap-user-dn="ou=users,dc=example,dc=com" </code></pre></div> <h4 id="authorization-and-access-control" class="position-relative d-flex align-items-center group"> Authorization and Access Control <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authorization-and-access-control" aria-haspopup="dialog" aria-label="Share link: Authorization and Access Control"> Share link </button> </h4>Geode implements fine-grained access control at multiple levels: Database-Level Permissions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant database access GRANT ACCESS ON DATABASE sales TO alice; -- Revoke access REVOKE ACCESS ON DATABASE sales FROM alice; </code></pre></div>Label-Level Permissions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant read access to specific node labels GRANT SELECT ON LABEL User TO alice; GRANT SELECT ON LABEL Product TO alice; -- Grant write access GRANT INSERT, UPDATE, DELETE ON LABEL Order TO alice; -- Read-only user GRANT SELECT ON ALL LABELS TO readonly_user; </code></pre></div>Property-Level Permissions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Grant access to specific properties only GRANT SELECT ON User(id, name, email) TO support_team; -- support_team cannot see User.ssn or User.salary -- Grant update on specific properties GRANT UPDATE ON User(email, phone) TO profile_editor; -- profile_editor can modify contact info, not other fields </code></pre></div>Row-Level Security (RLS): RLS policies filter query results based on user context: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- Create RLS policy: Users can only see their own data CREATE POLICY user_isolation ON User FOR SELECT USING (id = current_user_id()); -- Create RLS policy: Managers can see their team's data CREATE POLICY team_visibility ON Employee FOR SELECT USING ( EXISTS { MATCH (e:Employee)-[:REPORTS_TO]->(manager:Employee) WHERE manager.user_id = current_user_id() } ); -- Enable RLS on table ALTER LABEL User ENABLE ROW LEVEL SECURITY; ALTER LABEL Employee ENABLE ROW LEVEL SECURITY; </code></pre></div>Python usage with RLS: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">from geode_client import AuthClient, Client # User alice logs in client = Client(host="localhost", port=3141) async with client.connection() as conn: auth = AuthClient(conn) await auth.login("alice", "alice_password") # Query automatically filtered by RLS policy result, _ = await conn.query(""" MATCH (e:Employee) RETURN e.name, e.salary """) # Only returns employees alice manages (RLS policy applied) # Different user sees different results client = Client(host="localhost", port=3141) async with client.connection() as conn: auth = AuthClient(conn) await auth.login("bob", "bob_password") result, _ = await conn.query(""" MATCH (e:Employee) RETURN e.name, e.salary """) # Only returns employees bob manages </code></pre></div>RLS Policy Examples: Multi-tenant isolation: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE POLICY tenant_isolation ON ALL LABELS FOR ALL USING (tenant_id = current_tenant_id()); </code></pre></div>Time-based access: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE POLICY business_hours ON SensitiveData FOR SELECT USING (extract_hour(current_timestamp()) BETWEEN 9 AND 17); </code></pre></div>Role-based filtering: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">CREATE POLICY role_based_access ON Document FOR SELECT USING ( security_level <= ( MATCH (u:User {id: current_user_id()}) RETURN u.clearance_level ) ); </code></pre></div> <h4 id="data-encryption-at-rest" class="position-relative d-flex align-items-center group"> Data Encryption at Rest <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="data-encryption-at-rest" aria-haspopup="dialog" aria-label="Share link: Data Encryption at Rest"> Share link </button> </h4>Transparent Data Encryption (TDE): Geode encrypts database files automatically using AES-256-GCM: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Generate encryption key openssl rand -hex 32 > database-encryption-key.txt # Start server with TDE geode serve --listen 0.0.0.0:3141 \ --data-dir=/var/lib/geode \ --encryption-enabled=true \ --encryption-key-file=database-encryption-key.txt </code></pre></div>Key characteristics: <ul> <li>AES-256-GCM (authenticated encryption)</li> <li>Per-page encryption (16KB blocks)</li> <li>Low overhead (~5% performance impact)</li> <li>Protects against physical theft, backup leaks</li> </ul> Key Management Service (KMS) Integration: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Use AWS KMS for key management geode serve --listen 0.0.0.0:3141 \ --encryption-enabled=true \ --encryption-kms=aws \ --encryption-kms-key-id=arn:aws:kms:us-east-1:123456789012:key/abc-def \ --encryption-kms-region=us-east-1 </code></pre></div>Field-Level Encryption (FLE): Encrypt specific sensitive fields in application: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">from cryptography.fernet import Fernet from geode_client import Client # Application-managed encryption key encryption_key = Fernet.generate_key() cipher = Fernet(encryption_key) async def create_user_with_encrypted_ssn(name, ssn): # Encrypt SSN before storing encrypted_ssn = cipher.encrypt(ssn.encode()).decode() client = Client(host="localhost", port=3141) async with client.connection() as conn: await conn.execute(""" CREATE (u:User { name: $name, ssn_encrypted: $ssn_encrypted }) """, {"name": name, "ssn_encrypted": encrypted_ssn}) async def get_user_ssn(user_id): client = Client(host="localhost", port=3141) async with client.connection() as conn: result, _ = await conn.query(""" MATCH (u:User {id: $id}) RETURN u.ssn_encrypted """, {"id": user_id}) encrypted_ssn = result.bindings[0]['ssn_encrypted'] # Decrypt after retrieving ssn = cipher.decrypt(encrypted_ssn.encode()).decode() return ssn </code></pre></div>FLE vs TDE: <ul> <li>TDE: Protects stored files, transparent to application, database can query</li> <li>FLE: Protects specific fields, application-managed, database sees ciphertext</li> </ul> <h4 id="audit-logging" class="position-relative d-flex align-items-center group"> Audit Logging <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="audit-logging" aria-haspopup="dialog" aria-label="Share link: Audit Logging"> Share link </button> </h4>Comprehensive logging for compliance and forensics: Enable audit logging: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">geode serve --listen 0.0.0.0:3141 \ --audit-log-enabled=true \ --audit-log-file=/var/log/geode/audit.jsonl \ --audit-log-level=verbose </code></pre></div>Audit log format (JSON Lines): <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-json" data-lang="json">{ "timestamp": "2026-01-24T14:32:45.123Z", "event_type": "authentication", "username": "alice", "source_ip": "192.168.1.100", "status": "success" } { "timestamp": "2026-01-24T14:32:46.456Z", "event_type": "query", "username": "alice", "database": "production", "query": "MATCH (u:User {id: $id}) RETURN u", "params": {"id": 123}, "rows_returned": 1, "duration_ms": 2.4 } { "timestamp": "2026-01-24T14:32:50.789Z", "event_type": "authorization_failure", "username": "bob", "database": "production", "attempted_action": "DELETE", "resource": "User", "reason": "insufficient_privileges" } </code></pre></div>Audit log analysis: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python">import json def analyze_audit_log(log_file): failed_logins = {} with open(log_file) as f: for line in f: event = json.loads(line) if event['event_type'] == 'authentication' and event['status'] == 'failure': username = event['username'] failed_logins[username] = failed_logins.get(username, 0) + 1 # Alert on brute force attempts for username, count in failed_logins.items(): if count > 10: print(f"ALERT: {username} has {count} failed login attempts") analyze_audit_log("/var/log/geode/audit.jsonl") </code></pre></div> <h3 id="security-best-practices" class="position-relative d-flex align-items-center group"> Security Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-best-practices" aria-haspopup="dialog" aria-label="Share link: Security Best Practices"> Share link </button> </h3> <h4 id="principle-of-least-privilege" class="position-relative d-flex align-items-center group"> Principle of Least Privilege <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="principle-of-least-privilege" aria-haspopup="dialog" aria-label="Share link: Principle of Least Privilege"> Share link </button> </h4>Grant minimum necessary permissions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">-- BAD: Overly permissive GRANT ALL PRIVILEGES ON ALL LABELS TO app_user; -- GOOD: Specific permissions GRANT SELECT ON User(id, name, email) TO app_user; GRANT INSERT, UPDATE ON Order TO app_user; GRANT SELECT ON Product TO app_user; </code></pre></div> <h4 id="secure-credential-management" class="position-relative d-flex align-items-center group"> Secure Credential Management <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="secure-credential-management" aria-haspopup="dialog" aria-label="Share link: Secure Credential Management"> Share link </button> </h4>Never hardcode credentials: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"># BAD: Hardcoded password client = Client("localhost", 3141, username="app", password="hardcoded_pass") # GOOD: Environment variables import os client = Client( "localhost", 3141, username=os.getenv("GEODE_USERNAME"), password=os.getenv("GEODE_PASSWORD") ) # BETTER: Secrets management service from boto3.session import Session secrets_client = Session().client('secretsmanager', region_name='us-east-1') secret = secrets_client.get_secret_value(SecretId='geode/prod/credentials') credentials = json.loads(secret['SecretString']) client = Client( "localhost", 3141, username=credentials['username'], password=credentials['password'] ) </code></pre></div> <h4 id="regular-security-audits" class="position-relative d-flex align-items-center group"> Regular Security Audits <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="regular-security-audits" aria-haspopup="dialog" aria-label="Share link: Regular Security Audits"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"># Automated security checks async def security_audit(): client = Client("localhost", 3141, username="admin") async with client.connection() as client: # Check for users without passwords result, _ = await client.query(""" SHOW USERS WHERE password_set = false """) if result.bindings: print(f"WARNING: {len(result.bindings)} users without passwords") # Check for overly permissive grants result, _ = await client.query(""" SHOW GRANTS WHERE privilege = 'ALL' AND grantee NOT IN ('admin', 'root') """) if result.bindings: print(f"WARNING: {len(result.bindings)} users with ALL privileges") # Check TLS enforcement result, _ = await client.query("SHOW VARIABLES LIKE 'require_secure_transport'") if result.bindings[0]['value'] != 'ON': print("WARNING: TLS not enforced") await security_audit() </code></pre></div> <h4 id="defense-in-depth" class="position-relative d-flex align-items-center group"> Defense in Depth <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="defense-in-depth" aria-haspopup="dialog" aria-label="Share link: Defense in Depth"> Share link </button> </h4>Layer multiple security controls: <ol> <li>Network: Firewall rules, VPN, TLS</li> <li>Authentication: Strong passwords, MFA, certificate-based</li> <li>Authorization: RBAC, RLS policies</li> <li>Encryption: TDE for data at rest, TLS for data in transit</li> <li>Auditing: Comprehensive logging, monitoring, alerts</li> <li>Application: Input validation, parameterized queries, rate limiting</li> </ol> <h3 id="compliance-and-standards" class="position-relative d-flex align-items-center group"> Compliance and Standards <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="compliance-and-standards" aria-haspopup="dialog" aria-label="Share link: Compliance and Standards"> Share link </button> </h3>Geode’s security features support compliance with: GDPR (General Data Protection Regulation): <ul> <li>RLS for data access control</li> <li>Audit logging for data access tracking</li> <li>Encryption at rest and in transit</li> <li>Right to be forgotten (data deletion)</li> </ul> HIPAA (Health Insurance Portability and Accountability Act): <ul> <li>Encryption of PHI (Protected Health Information)</li> <li>Access controls and authentication</li> <li>Audit trails for PHI access</li> <li>Data integrity verification</li> </ul> PCI DSS (Payment Card Industry Data Security Standard): <ul> <li>Strong access control measures</li> <li>Network security (TLS 1.3)</li> <li>Encryption of cardholder data</li> <li>Logging and monitoring</li> </ul> SOC 2 (Service Organization Control 2): <ul> <li>Access controls and authentication</li> <li>Encryption and secure data handling</li> <li>Audit logging and monitoring</li> <li>Incident response procedures</li> </ul> <h3 id="troubleshooting-security-issues" class="position-relative d-flex align-items-center group"> Troubleshooting Security Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting-security-issues" aria-haspopup="dialog" aria-label="Share link: Troubleshooting Security Issues"> Share link </button> </h3> <h4 id="issue-tls-handshake-failures" class="position-relative d-flex align-items-center group"> Issue: TLS Handshake Failures <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="issue-tls-handshake-failures" aria-haspopup="dialog" aria-label="Share link: Issue: TLS Handshake Failures"> Share link </button> </h4>Symptoms: Connection refused or TLS errors Diagnosis: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Test TLS connection openssl s_client -connect localhost:3141 -tls1_3 # Check certificate validity openssl x509 -in server-cert.pem -text -noout </code></pre></div>Solutions: <ul> <li>Verify certificate hasn’t expired</li> <li>Ensure client trusts server certificate</li> <li>Check TLS cipher suite compatibility</li> </ul> <h4 id="issue-authentication-failures" class="position-relative d-flex align-items-center group"> Issue: Authentication Failures <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="issue-authentication-failures" aria-haspopup="dialog" aria-label="Share link: Issue: Authentication Failures"> Share link </button> </h4>Symptoms: “Access denied” errors Diagnosis: Check audit logs: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">grep "authentication.*failure" /var/log/geode/audit.jsonl </code></pre></div>Solutions: <ul> <li>Verify username/password are correct</li> <li>Check account isn’t locked</li> <li>Ensure user has database access</li> </ul> <h4 id="issue-permission-denied-errors" class="position-relative d-flex align-items-center group"> Issue: Permission Denied Errors <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="issue-permission-denied-errors" aria-haspopup="dialog" aria-label="Share link: Issue: Permission Denied Errors"> Share link </button> </h4>Symptoms: “Insufficient privileges” errors Diagnosis: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-gql" data-lang="gql">SHOW GRANTS FOR alice; </code></pre></div>Solutions: <ul> <li>Grant necessary permissions</li> <li>Check RLS policies aren’t overly restrictive</li> <li>Verify user is accessing correct database</li> </ul> <h3 id="related-topics" class="position-relative d-flex align-items-center group"> Related Topics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="related-topics" aria-haspopup="dialog" aria-label="Share link: Related Topics"> Share link </button> </h3><ul> <li><a href="/tags/authentication/" >Authentication</a> : Authentication mechanisms in depth</li> <li><a href="/tags/encryption/" >Encryption</a> : Encryption implementation details</li> <li><a href="/tags/row-level-security/" >Row-Level Security</a> : RLS policies and patterns</li> <li><a href="/tags/tde/" >TDE</a> : Transparent Data Encryption</li> <li><a href="/tags/fle/" >FLE</a> : Field-Level Encryption</li> <li><a href="/tags/compliance/" >Compliance</a> : Regulatory compliance</li> <li><a href="/tags/audit-logging/" >Audit Logging</a> : Audit logging configuration</li> </ul> <h3 id="further-reading" class="position-relative d-flex align-items-center group"> Further Reading <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="further-reading" aria-haspopup="dialog" aria-label="Share link: Further Reading"> Share link </button> </h3><ul> <li>Security Overview: <code>/docs/security/overview/</code></li> <li>Authentication Guide: <code>/docs/security/authentication/</code></li> <li>Authorization and RBAC: <code>/docs/security/authorization/</code></li> <li>Encryption Best Practices: <code>/docs/security/encryption/</code></li> <li>Compliance Guide: <code>/docs/security/compliance/</code></li> <li>Security Hardening Checklist: <code>/docs/security/hardening/</code></li> </ul>

Popular

Related Articles

Security and Compliance Guide

Authentication

Authorization

Post-Quantum Readiness & Cryptography

Session Management Guide

Production Deployment Guide

Fraud Detection Guide

Security

Audit Logging and Compliance

Password Hashing with Argon2id