Skip to main content
DBDock handles sensitive things: database credentials, storage keys, and the contents of your backups. Security isn’t a feature bolted on — it shapes how both the CLI and the cloud are built. This page is the map; each area links to the details.

​
Principles

Encrypt by design

Backups are encrypted with AES-256-GCM. On DBDock Cloud paid plans, encryption is on by default.

Secrets stay out of config

Passwords and keys live in environment variables, never in dbdock.config.json. Config is safe to commit.

Metadata-only sync

Cloud Sync uploads configuration metadata, never credentials or backup contents.

Isolation in the cloud

Your account’s data is scoped to you. Requests are authenticated and access is confined to your own resources.

​
The three areas

Encryption

How backups are encrypted, credential masking, and .pgpass.

Cloud security

Sign-in, data at rest, isolation, and the MCP server.

Key management

Where secrets should live, in CI and in production.

​
Secrets never live in the config file

DBDock enforces a strict split between non-sensitive configuration and secrets: This same split is what makes Cloud Sync safe: the parts that are safe to commit are the parts that sync, and nothing else.

​
Credential masking

DBDock masks credentials in log output by default, so pasting logs into an issue or sharing your screen doesn’t leak a password:

​
Reporting a vulnerability

Please do not file public GitHub issues for security vulnerabilities.