Security and Authentication

Security and Authentication

A fresh data directory creates root with the initial password supplied by --root-password or Docker ROOT_PASSWORD; the development default is admin. Set a strong secret before exposing any listener.

MemCP supports users, password changes, grants/revokes, and database access policies through SQL and the dashboard. Use a least-privilege account for each application and a separate read-only account for migration or validation.

HTTP endpoints use Basic authentication. Protect them with TLS at a trusted reverse proxy or private network; Basic credentials are only encoded, not encrypted. Restrict the MySQL TCP port and Unix socket. Disable unused API or MySQL listeners.

SQL/Scheme consoles, process controls, settings, logs, custom handlers, and storage-backend credentials are administrative capabilities. Logs can contain queries and data. Config files, data directories, sockets, backups, and remote credentials require filesystem/service permissions appropriate to the deployment.

MemCP is Beta and should be defense-in-depth deployed. Test authentication and authorization while logged out and as every role after upgrades.