tabularis

Least-privilege permissions

• Create separate database accounts for Tabularis with only the minimum access needed (e.g., read-only access to non-sensitive tables, no admin rights). Never use your main production database credentials.
• Store credentials securely using your operating system's credential manager (Windows Credential Manager, macOS Keychain, Linux secret-service) rather than plain-text config files that could be accidentally exposed.
• Restrict file access to the Tabularis configuration folder on your computer—use OS-level permissions to ensure only authorized users can read stored connection strings.
• Separate AI agent access from your personal queries—create a dedicated low-privilege database user specifically for Claude/AI agent operations, distinct from your own account.

Network isolation

• Run Tabularis on trusted networks only—avoid using it on public WiFi or untrusted networks where traffic could be intercepted.
• Disable the MCP server when not actively using AI agents to interact with your databases; this reduces the exposure window for unauthorized connections.
• Use VPN or private networks to connect to production databases rather than exposing database ports directly to the internet.
• Firewall your machine to block inbound connections to Tabularis and only allow outbound connections to your known, authorized databases.

Monitoring

• Log all AI agent queries and review them regularly for unexpected or suspicious SQL commands, especially those involving data deletion or modification.
• Monitor database access patterns on your backend systems for unusual activity (unexpected users, off-hours access, large data transfers) that might indicate credential compromise.
• Keep Tabularis and plugins updated by checking for security patches weekly; subscribe to the project's GitHub release notifications to catch critical updates quickly.
• Audit config file changes by reviewing when and how your connection credentials are modified, treating these files as sensitive audit logs.

Red flags to watch for

• Unexpected plugin installations or updates that you didn't authorize—manually verify each plugin's source and review its code before running.
• Large data exports or unusual query results being sent to Claude/LLM APIs, which could indicate misconfiguration or prompt injection attacks.
• Slow performance or unusual CPU usage on your machine while Tabularis is running, which might signal malicious code execution or data exfiltration.
• Unrecognized queries in your database logs—if you see SQL commands you didn't write, immediately change your database credentials and investigate potential credential leakage from Tabularis.