The initial 0.1 alpha line is under development. No production-readiness or independent security-audit claim is made. Fixes target the current development line; users should follow release notes before upgrading.
Use GitHub's Security → Report a vulnerability on this repository: https://github.com/velobase/dsh-postgres/security/advisories/new
Include affected versions, reproduction details, and the security impact. Do not open a public issue with credentials, session contents, or an exploit against a live service. No response-time SLA is promised.
Namespace scoping protects queries issued through the plugin. It is not PostgreSQL row-level security, an authentication service, or a sandbox for untrusted plugins. A process with the database credentials can access its SQL privileges across namespaces. Hosts must authenticate users, select namespaces server-side, constrain exposed tools, and keep database credentials private.
Use a separate migration role and a least-privilege runtime role. Protect database connections and backups using the deployment's normal controls.
The pinned DSH 0.2.1-rc.3 dependency graph includes Zod 4.4.3, affected by GHSA-mrhx-c7xc-m3w5. This repository overrides that transitive dependency to 4.6.6 for development. npm does not apply dependency-package overrides to the consuming host. Hosts using this DSH version must independently resolve the advisory in their root dependency policy. See the deployment guide for the exact override.