Security

What FASTBASE does to protect your account, your app and your data — and what it does not do yet. The engineering detail is in docs/SECURITY.md in the repository.

Your account

Passwords are stored as salted scrypt hashes. FASTBASE cannot read them.
Dashboard sessions use an HttpOnly cookie. Every change made from the dashboard also carries a CSRF token.
Access tokens are shown once and stored only as hashes. Give each tool its own token with the smallest set of scopes, and revoke it under Settings → Access tokens when it is no longer needed.
Sign-in endpoints are rate limited.
Two-factor sign-in: Settings → Your account security. A code from an authenticator app is then required after the password, for the dashboard and the CLI.
Password reset signs you out everywhere and revokes your access tokens.

Your team

Four roles: Owner, Admin, Developer, Viewer. Viewers cannot change anything. Deleting projects, databases and buckets, restoring backups and rotating keys need an Admin. A workspace always keeps at least one Owner.

Other workspaces’ projects are invisible: asking for one returns “not found”.

Your secrets

Environment variable values and database passwords are encrypted at rest and are write-only.
They are masked in build logs, runtime logs and function logs.
They never appear in the audit log — only variable names do.
A local .env file is never uploaded with your source.
The secret project key is never exposed to browser code.

Your data

Each project database has its own role and cannot be reached with another project’s credentials.
Private files need the secret key, a signed link, or the signed-in owner.
Uploaded files are served so that they cannot run scripts in a visitor’s browser.

Destructive actions

Deleting a project, a database or a bucket, and restoring a backup over live data, require typing the resource’s name. The server checks the phrase itself; the AI Engineer and API clients cannot skip it, and the MCP server has no destructive tools at all.

The AI Engineer

It can only propose steps from a fixed catalog. You approve a plan before anything runs, it runs with your permissions, and every step is recorded in the audit log as FASTBASE AI (approved by you).

Audit log

Admins can see who deployed, who changed which variable name, who added a domain, and what the AI did, under Settings → Audit log.

What to know about the current release

FASTBASE is in beta. Be aware of these limits:

App isolation depends on the compute provider. With the default local process provider, apps run as ordinary processes on the FASTBASE machine and are not sandboxed from each other. Run only code you trust on such an installation. Multi-tenant hosting requires the Docker provider (or stronger).
Tables have no row-level security. That is why table access needs the secret key.
Realtime permissions are name-based (private:, user:<id>); there are no custom per-channel rules.
Database backups are stored on the same server as the database with the built-in provider.

Reporting a problem

Send security reports to the operator of your FASTBASE installation. Please do not open public issues for vulnerabilities.