Database Security

Why Does Your Data Need Protection?

When you build a website or app, you’re storing information-user accounts, orders, messages, preferences. Without protection, anyone visiting your site could potentially see or change anyone else’s data.

Imagine if any visitor to an online store could see everyone’s order history, or change someone else’s shipping address. That would be a disaster!

Security rules act like locks on doors. They make sure only the right people can access the right information. Sticklight sets up these locks automatically, so you don’t have to worry about the technical details.

Security is configured automatically when you enable Cloud Backend and create tables.

Public vs Private Data

Before diving deeper, let’s clarify two important concepts:

Public Data is information anyone can see, even visitors who aren’t logged in. Think of it like a store window-everyone walking by can look inside.

Examples of public data:

• Product listings on a shop
• Blog posts
• FAQs and help articles
• Restaurant menus

Private Data is information only specific people should see or edit. Think of it like a safe deposit box-only the owner has the key.

Examples of private data:

• Shopping carts (only you should see yours)
• Personal profiles
• Order history
• Saved passwords
• Private messages

Most apps have a mix of both. Sticklight helps you decide which is which.

What is Row Level Security (RLS)?

You might see the term “RLS” in Sticklight. Here’s what it means in plain English:

• A row is one item in your data-one user, one order, one comment, one product
• Row Level Security means each item gets checked individually before being shown to someone

Think of it like a bouncer at a club. The bouncer doesn’t just open the door for everyone-they check each person’s ID and decide if that specific person is allowed in.

With RLS, every time someone tries to view, add, edit, or delete data, Sticklight checks: “Is this person allowed to do this to this specific item?”

How Sticklight Protects Your Data Automatically

When you ask Sticklight to build something (like a “Recipe Sharing App”), our AI automatically figures out which data needs protection.

AI Synthesis: As your database tables are created, Sticklight assigns security settings. For example, it might decide “Recipes are public” but “User favorites are private.”

Refinement Loop: If something is unclear, the AI will ask you. For example: “Should users be able to delete their own reviews?” Your answer helps set up the right rules.

Default Deny: Here’s an important safety feature-if there’s no rule saying someone CAN access data, they CAN’T. It’s locked by default. This prevents accidental data exposure.

Understanding Roles & Permissions

Sticklight uses four types of users (called “roles”) when deciding who can access what:

Public – Anyone on the internet, including people who haven’t signed up or logged in. These are anonymous visitors just browsing your site.

Logged-in – Anyone who has created an account (via email/password or Google Sign-In) and is currently signed in. You know who they are, but they don’t have any special privileges.

Owner – A logged-in user accessing data they personally created. For example, a customer viewing their own order history, or a user editing their own profile.

Admin – A special high-level role for people who manage the app. Admins often have access to everything.

For each table in your database, you can set different permissions for each role. For example:

• Public visitors can view products
• Logged-in users can add reviews
• Owners can edit their own reviews
• Admins can delete any review

Note: You need to set up an “Admin” role in your User Settings before you can use Admin-specific permissions.

Security Badges

Each table in your Data Dashboard displays a security badge-a quick visual indicator showing who can access that table.

You’ll see labels like:

• Personal – Only owners can access their own data
• Public – Anyone can view the data

These badges help you quickly audit your app’s security without diving into the detailed settings.

Viewing RLS Policies

Want to see exactly what security rules are in place? Here’s how:

1. Navigate to the Data tab in your Studio
2. Click on Permissions
3. You’ll see all your security rules listed

You can ask the AI to explain or change any of these rules at any time.

Editing Permissions with AI

Need to change who can access what? You don’t need to understand technical security-just tell the AI what you want in plain English.

1. Go to Database → Permissions
2. Click Edit Permissions with AI
3. The Chat will open with the right context
4. Describe what you want to change

Example requests:

• “Make the recipes table public so anyone can browse”
• “Only let users edit their own profiles”
• “Allow admins to delete any comment”

Trust & Consent: Before making changes, the AI will explain what it’s about to do and ask for your confirmation. If you need to set up user accounts or roles first, it will guide you through that process.

Real World Example

Let’s walk through a concrete scenario to see how this all fits together.

Scenario: You’re building a recipe sharing app.

Table	Who Should See It?	Security Setting
recipes	Everyone can view, admins can delete any	Public view, Admin delete
users	Owners see their own, admins see all	Personal + Admin full access
saved_favorites	Only the user who saved them	Personal – owners only
comments	Everyone reads, authors edit, admins delete any	Public read, Owner edit, Admin delete

Admin powers: In this app, admins can view all user accounts (to help with support), delete inappropriate recipes, and remove any comment that violates guidelines-without needing to be the original author.

When Sticklight creates these tables, it will ask you questions like:

• “Should recipes be visible to everyone, or only logged-in users?”
• “Can users delete their own comments?”
• “Should admins be able to manage all content?”

Your answers shape the security rules. And if you change your mind later, just ask the AI to update them.

Pro Tips for a Secure App

Automatic Indexing: Sticklight creates database indexes for your security rules automatically. This keeps your app fast even as your data grows-you don’t need to do anything.

Admin Prerequisite: If you try to set an “Admin” permission before creating an Admin role, the AI will pause and help you set up the role first. It won’t let you create rules that can’t work.

Centralized Audit: Click the Permissions button in your Data Dashboard anytime to see all security rules across your entire project in one place.