Security
Security
DBCode is local-first: it runs inside your editor and connects directly to your databases. Credentials, queries, and results stay on your machine. There is no DBCode server in the query path, so there is no server for your data to leak from. A few optional features (AI, Secure Sharing, History Sync, license activation) do reach our infrastructure, and every one is listed with its exact payload and retention in Network Egress.
DBCode holds no SOC 2, and this page says so plainly. What it offers instead is evidence you can check without trusting us: an egress table written to be verified with a proxy, an SBOM your own scanner can read, and a signed build attestation you can verify with one command.
Artifacts for reviewers
Section titled “Artifacts for reviewers”Assessing DBCode? Start with these. Each artifact says how to check it for yourself.
| Artifact | What it answers | How to check it |
|---|---|---|
| Network Egress | Every domain DBCode can contact, what triggers it, what it sends, how long it is kept, and how to switch each one off | Run DBCode behind a proxy and compare |
| Build & Release Integrity | How the package you install is built in public from an exact commit, scanned, and signed | gh attestation verify against any release from v1.36.6 onward |
| Software Bill of Materials | The full production component list of every release, as CycloneDX | Feed it to Grype, Trivy, or Dependency-Track |
| Subprocessors | Who else touches data and what they touch | Reads in one table below |
| security.txt | Where to report a vulnerability, and our disclosure policy | RFC 9116, at the well-known path |
If your review needs something that isn’t here, ask: security@dbcode.io.
Local-First Architecture
Section titled “Local-First Architecture”DBCode runs entirely within VS Code on your local machine. Here’s what that means for your data:
Your Data Stays on Your Computer
Section titled “Your Data Stays on Your Computer”- Database connections are made directly from your computer to your database servers
- Query results are processed and displayed locally in VS Code
- Connection credentials are optionally stored on your device with multiple security options, or can be entered each session
- Query history and notebooks are saved to your local filesystem
No DBCode Servers in the Middle
Section titled “No DBCode Servers in the Middle”Unlike cloud-based database tools, DBCode does not route your database traffic through our servers:
- We never see your database credentials
- We never access your databases
- We never receive your query results
- We have no ability to view your data
Your database connections go directly from VS Code on your machine to your database servers. DBCode is simply the interface that runs locally.
Credential Storage
Section titled “Credential Storage”DBCode offers multiple options for storing database credentials, all managed locally on your device:
- VS Code Secret Storage (default) - Credentials stored in your operating system’s secure keychain
- Encrypted Storage - Credentials encrypted with a passphrase you control
- Session-Only - Credentials kept in memory, cleared when VS Code closes
- No Storage - Enter credentials each time you connect
See Password Storage for detailed information on each option.
Optional Cloud Features
Section titled “Optional Cloud Features”DBCode offers two optional features that transmit encrypted data to cloud storage. Both use zero-knowledge encryption: data is encrypted on your device before transmission, and we cannot decrypt it.
Secure Sharing
Section titled “Secure Sharing”Secure Sharing lets you share query results with others using end-to-end encryption:
- Encryption happens on your computer - Data is encrypted using AES-256-GCM before it ever leaves your machine
- Only encrypted data is transmitted - We receive and store data we cannot decrypt
- You control the passphrase - The encryption key is derived from a passphrase that never leaves your computer
- Recipients decrypt locally - Data is decrypted on the recipient’s device, not our servers
- Automatic expiration - Shared data expires and is permanently deleted
Bring Your Own Storage
Section titled “Bring Your Own Storage”EU data residency is available by selecting the European Union storage region, which keeps your encrypted data in Cloudflare’s EU jurisdiction. For full control over location and retention, you can also configure Secure Sharing to use your own S3-compatible storage:
- Use your own AWS S3 bucket
- Use any S3-compatible storage (MinIO, Backblaze B2, Cloudflare R2, etc.)
- Encrypted data never touches DBCode infrastructure
- Full control over data location and retention
See Secure Sharing for complete details.
History Sync
Section titled “History Sync”History Sync lets you sync your query history across devices with end-to-end encryption:
- Client-side encryption - History is encrypted on your device using AES-256-GCM before upload
- Zero-knowledge storage - Only encrypted data and an encrypted key envelope are stored; we cannot decrypt them
- Passphrase protected - Your passphrase never leaves your device and is never stored by us
- Multi-device support - Sync history across all your devices using the same passphrase
See History Sync for complete details.
Team Feature Controls
Section titled “Team Feature Controls”On team plans, admins can control which DBCode features each member can use through Team Roles. Built-in roles (such as no-export and restricted) and custom roles can disable:
- AI features, either as a whole or individually (completions, analysis, query builder, explore, grid)
- History Sync
- Data Export, Data Copy, and Data Share
Restricted features appear disabled with a “Restricted by your team role” message rather than being hidden. Role definitions are stored in your Stripe subscription metadata, cached locally on each member’s machine, and refreshed every 12 hours.
Roles are a policy tool, not a security boundary. They enforce company guidelines inside the extension, but a determined user could sign out, use a different client, or connect to the database directly. For protecting sensitive data, use database-level access controls (grants, row-level security, network rules) as the primary mechanism. Roles complement those controls, they don’t replace them.
Connection Security
Section titled “Connection Security”Database connections originate from your machine, so whether traffic is encrypted depends on your connection settings and what the target server supports. DBCode gives you the controls:
- Auto SSL - For recognized cloud hosts (AWS RDS, Azure SQL, Neon, Supabase, Timescale, CockroachDB Cloud, YugabyteDB), DBCode automatically enables SSL and downloads the required public certificates. See Auto SSL.
- Manual SSL/TLS - Provide your own CA, client certificate, and key for any connection.
- SSH tunnels - Reach databases that aren’t publicly exposed through an encrypted SSH tunnel. See SSH Tunnels.
Because DBCode runs locally it cannot force a server to accept encryption, but it supports encrypted connections and, for known cloud hosts, enables them by default.
Subprocessors
Section titled “Subprocessors”DBCode’s local features use no third parties. The optional cloud features rely on a small set of subprocessors. In every case the data they handle is either encrypted so we cannot read it, or sent only when you explicitly invoke an AI action:
| Subprocessor | Purpose | Data handled |
|---|---|---|
| Cloudflare (Workers, Workers AI) | Hosts the dbcode.io site and runs the hosted AI models | AI request payloads (schema, and on request, query results); not stored, not used for training |
| Cloudflare R2 | Stores encrypted blobs for Secure Sharing and History Sync | Ciphertext only (zero-knowledge); we cannot decrypt it |
| Stripe | Payments, subscriptions and team seat/role records | Billing details you enter with Stripe; team role assignments held in subscription metadata |
| PostHog | Product usage telemetry, proxied through dbcode.io/ingest | Anonymous install id, feature-usage events, redacted error reports. Off entirely when VS Code telemetry is disabled |
| Google Workspace | Support email to mike@dbcode.io | Whatever you choose to send us, including any attachments |
| Linear | Issue tracking and triage of support requests | Support requests that arrive by email or from GitHub, and the identity attached to them. This is the subprocessor most likely to hold something sensitive, because it holds whatever you put in a bug report |
| GitHub | Public issue tracker and release hosting | Anything you post in a public issue. Note that this channel is public: issues on dbcodeio/public are visible to anyone |
For Secure Sharing you can bring your own S3-compatible storage, in which case encrypted data never touches DBCode infrastructure. See AI Privacy and Security for the full AI data-flow breakdown.
Data Retention and Deletion
Section titled “Data Retention and Deletion”- Local data (connections, query history, notebooks) lives on your filesystem and is removed when you delete it. DBCode keeps no copy.
- Secure Sharing - You choose a storage region (Americas, the European Union, or Asia-Pacific) and an expiry window per share. The European Union region stores your encrypted data in Cloudflare’s EU jurisdiction. Encrypted data is automatically and permanently deleted when it expires.
- History Sync - Snapshots are created every 7 days. Incremental updates are retained for 1 month and snapshots for 6 months. Stored blobs are client-side encrypted with AES-256-GCM, with server-side encryption at rest as a secondary layer.
Build and Release Integrity
Section titled “Build and Release Integrity”Every release is built by a public GitHub Actions workflow from an exact, tagged commit, scanned with two antivirus engines, attested with Sigstore, and only then published. The source is closed; the process that turns it into the package you install is not. Build & Release Integrity walks the pipeline and shows how to verify a release yourself. Every release from v1.36.6 onward is built and attested through it.
Summary
Section titled “Summary”| Feature | Data Location | DBCode Access |
|---|---|---|
| Database connections | Your computer | None |
| Query execution | Your computer | None |
| Query results | Your computer | None |
| Credentials | Your computer (optional) | None |
| Notebooks | Your computer | None |
| Secure Sharing (optional) | Cloudflare R2 (encrypted) | Encrypted only - cannot decrypt |
| History Sync (optional) | Cloudflare R2 (encrypted) | Encrypted only - cannot decrypt |
Bottom line: DBCode is a local tool. Your databases, credentials, and data stay on your machine. The only features that transmit data are the optional ones listed above: AI features you invoke, Secure Sharing, History Sync, and license activation. Secure Sharing and History Sync encrypt on your device before transmission with zero-knowledge architecture, so we cannot decrypt your data.
Compliance
Section titled “Compliance”DBCode does not hold a SOC 2 report. Because DBCode is a local-first editor extension rather than a multi-tenant SaaS, the data such an audit protects never reaches our infrastructure in the first place. What we publish instead is designed to be independently verifiable: Network Egress, the SBOM, and build attestation. If your procurement process requires a completed questionnaire (SIG, CAIQ, or your own), contact security@dbcode.io.
Reporting a Vulnerability
Section titled “Reporting a Vulnerability”If you believe you’ve found a security vulnerability in DBCode, report it privately to security@dbcode.io. Include steps to reproduce, affected versions, and any relevant details. We’ll acknowledge your report, investigate, and keep you posted on remediation. Please don’t disclose the issue publicly until we’ve had a chance to address it.