Why Your Database Client Shouldn't Write to Your Project Directory

At 2:47 AM, a junior engineer's compromised database client silently rewrote migration scripts across twelve microservice repositories. The client had been granted write access to the entire project tree for "convenience." The blast radius: three hours of rollback across staging and pre-prod before anyone noticed the corrupted schema definitions.

A database client should make connecting easier. It should not quietly turn a disposable development environment into a privileged extension of your workstation.

I am evaluating t8y2/dbx as an external integrator. Its stated scope is attractive: a roughly 25 MB, cross-platform client supporting more than 100 databases, with desktop, CLI, and Docker delivery options. For this evaluation, however, I want one boundary established before testing features: the database environment must not have write access to my project or home directory.

The configuration below supplies that environment.…