Please do not open a public issue for security problems.

Report vulnerabilities through GitHub's private vulnerability reporting: go to the repository's Security tab and click Report a vulnerability. If that is not available, open a minimal issue asking for a private contact channel without disclosing details.

Include, when possible:

• A description of the issue and its impact.
• Steps to reproduce (CLI version, OS, command, observed vs expected behavior).
• Any proof of concept, logs or screenshots.

We aim to acknowledge reports within a few business days.

This repository covers the open-source easysql-cli (the npm package @easysql/cli and the standalone GitHub Releases binaries). The EasySQL API and dashboard are out of scope here.

The CLI is designed around one invariant: database credentials never leave the host.

• Only schema metadata is sent to the API (tables, columns, types, primary_keys, foreign_keys, row_count_estimate). Passwords, hosts and ports are never transmitted.
• Database passwords are resolved locally in this order: $EASYSQL_DB_PASSWORD → OS keyring (macOS Keychain / libsecret / Windows Credential Manager; opt-in via connection add --save-password or connection sync --save-password) → interactive prompt. connections.json never contains a password, and nothing in this chain is ever sent to the API. Set EASYSQL_KEYRING=0 to disable keyring use entirely.
• The EasySQL API key is stored in ~/.config/easysql/config.json with 0600 permissions (best-effort on Windows).
• Generated SQL is validated server-side, and the CLI additionally rejects any non-SELECT statement before touching the local database (defense in depth).
• SQLite connections carry no credentials at all; the file path stays in the local connections.json.

Security fixes are applied to the latest released version. Please upgrade with easysql update before reporting.