Repository navigation
Add a "securing DataFusion" documentation #26061
Description
Activity
To anyone who wants to do this, please don't just dump an AI generated doc on us
You should put yourself in the role of someone using DataFusion and give a high level explanation about configuring it for security and then give doc links and a BRIEF description (a sentence or less) of the various settings and WHY they contribute to the security posture / hardening
take
Thanks @alamb for opening this 🥇
Reacted by Andrew Lamb- added a commit that references this issue
on Oct 9, 2026
Metadata
Metadata
Assignees
Labels
No labels
I added an initial security policy in this PR
@samueleresca noted (❤️ ) in #25917 (comment) that it would be helpful to add additional documentation on how to harden DataFusion from threats by explicitly state the configurations that contribute to security hardening and their default.
For example, DuckDB does something similar in their operations manual.
Some corresponding examples in the DataFusion domain from @samueleresca:
SQLOptionsandwith_allow_ddl,with_allow_dml,with_allow_statementsare all allowed by default, as already mentioned.He suggested
I would personally suggest adding a new page in our library user guide here: