Security

3 in-depth guides on security for teams running self-hosted, privacy-first web analytics.

3 guides on security.

All 51 Architecture 25 Metrics 13 DuckDB 9 Performance 9 Privacy 9 SQL 7 Comparison 5 Data Modeling 5 Self-Hosting 4 Google Analytics 3 Security 3 AI 2 MCP 2 A/B Testing 1 API 1 Caching 1 Integrations 1 SEO 1

Safely Letting Users Run SQL Against Your Analytics

Exposing a SQL editor to users means accepting arbitrary queries. Parse-and-allowlist beats regex blocklists, plus row caps, statement timeouts and per-site scoping that cannot be escaped.

Aug 26, 20268 min readRead

Storing Third-Party API Keys Safely in a Self-Hosted App

Users paste credentials into your app. How to encrypt them at rest with AES-256-GCM, why the key must never come back to the browser, and what a masked hint is for.

Aug 20, 20267 min readRead

Multi-Tenant Analytics: Isolating Sites Properly

One instance, many sites, many users. Membership tables over ownership columns, enforcing scope in middleware rather than per-route, and why the AI and SQL layers need the same check.

Aug 8, 20268 min readRead