Report suspected vulnerabilities privately through the repository owner's security contact or GitHub private vulnerability reporting. Do not include live credentials, customer data, or production databases in a public issue.

• Keep SQL in trusted Nginx configuration and expose only declared parameters.
• Prefer sqlite_db_mode read_only and sqlite_read_only on for read APIs.
• Keep sqlite_authorizer, sqlite_validate, sqlite_foreign_keys, and sqlite_warmup_strict enabled.
• Load bearer secrets with sqlite_bearer_token_file from a root-managed file; never commit production tokens.
• Set body, row, response, busy, and query limits for the workload.
• Restrict database and migration file permissions to the Nginx worker and deployment identities that need them.
• Back up and verify a database before schema changes. The included migration runner can create a consistent backup with SQLITE_MIGRATIONS_BACKUP_ENABLED=true.
• Run Nginx and SQLite security updates promptly and rebuild the dynamic module against the exact installed Nginx version.

The module disables extension loading and its default authorizer denies ATTACH, DETACH, operation-level PRAGMA, and SQLite extension/file helper functions. Turning the authorizer off expands the trusted SQL boundary.