System Safeguards & Operational Directives

Security Policy

Detailed breakdown of MagnumDB's security model, missing network safeguards, and strict local deployment rules.

Security Model & System Safeguards

Security Policy & Known Limitations

MANDATORY OPERATIONAL DIRECTIVE:

DO NOT EXPOSE MAGNUMDB TO THE PUBLIC INTERNET.

MagnumDB does not implement TLS encryption or modern network hardening. Deploy strictly within local loopback interfaces (127.0.0.1) or isolated development networks.

No TLS Encryption

Network socket communication over TCP port 5432 is unencrypted plaintext.

MD5 Authentication

Password verification uses legacy MD5 challenge responses without SCRAM-SHA-256.

Default Superuser Privilege

The default postgres role operates with full superuser permissions without RBAC scoping.

Read Committed Isolation

Snapshot isolation is limited to Read Committed. Non-repeatable reads may occur.

Serialized Commit Writes

Transaction commits acquire exclusive write locks, serializing throughput.

Unenforced Foreign Keys

FOREIGN KEY clause syntax parses, but referential integrity constraints are not enforced.

Recommended Network Configuration

When running MagnumDB in Standalone TCP Server mode (cargo run --bin magnumdb --release), explicitly bind the socket listener to localhost:

$ magnumdb --bind 127.0.0.1 --port 5432

Reporting Vulnerabilities

If you discover a security issue or crash vulnerability in MagnumDB, please report it via private security advisory on GitHub or directly to Soham Das (@sohamdev77).