Security
Understand BaseBuddy app data, credentials, auth, TLS, storage, and diagnostics safety.
Treat BaseBuddy app data as sensitive. By default that is basebuddy-data/basebuddy.config.json. If you use a Supabase/Postgres app-data backend, it is the basebuddy.app_state row. It contains local user records, password hashes, session hashes, projects, members, permissions, invitations, mappings, and sidebar settings.
Database URLs, signing secrets, Supabase server keys, and S3 secrets belong in env, not in the config file.
Keep Private
Never publish:
basebuddy-data/basebuddy.config.jsonbasebuddy-data/basebuddy.audit.jsonlbasebuddy.app_stateexportsbasebuddy.audit_eventsexports- full database URLs
- storage server keys
- S3 access keys
- signed URL query strings
- private content screenshots
Auth
BaseBuddy uses local email/password users stored in the config file. Sessions use signed HttpOnly cookies.
Storage
Supabase Storage and S3-compatible storage are still supported for mapped content assets. Keep provider keys private and configure bucket permissions deliberately.
Database Roles
Use a restricted database role for BASEBUDDY_CONTENT_DATABASE_URL in production. Grant only the schemas, tables, and columns editors should read or edit. BaseBuddy checks column update privileges when the editor opens and shows fields as read-only when the current database role cannot update them.
Do not use the broad postgres owner role for routine editing.
TLS
Use TLS verification for hosted Supabase/Postgres connections. Do not use sslmode=no-verify.
If your database provider requires a custom root certificate, add it to the database URL:
shBASEBUDDY_CONTENT_DATABASE_URL="postgresql://...?sslmode=verify-full&sslrootcert=/absolute/path/to/root.crt"Local Postgres/Supabase can use sslmode=disable when the database is only reachable from your development machine.
Diagnostics
Setup diagnostics redact secrets. Still, review logs before sharing them because host output can include surrounding env or process details.