Learn how to secure Postgres from common blind spots across development and production. Sakshi Nasha (Software engineer) shares her approach in her talk “From Dev to Prod: Securing Postgres the Right Way” at POSETTE: An Event for Postgres 2026. Abstract: Is your Postgres database really secure, or just “working”?  Why do security issues keep showing up after launch? Many teams rely on defaults until an incident proves otherwise. 

This session tackles common Postgres security blind spots developers face in real systems. We’ll walk through practical techniques to secure access, data, and operations without slowing delivery and enhance the security posture of your application.

Key Takeaways:
1. Least-privilege roles, schema isolation, Role design and permission boundaries
2. Protecting data at rest and in transit
3. Safe extension and function usage
4. New Postgres enhancements around security and observability

Join me to turn security into a design habit, not an afterthought. Looking forward to engaging with you. Let’s make the Postgres world a little more fun and secure!!

Sakshi Nasha is a Software Engineer with a passion for building software and driving diversity in tech. An open-source enthusiast and OpenSearch Ambassador, she actively contributes to FOSS communities and speaks internationally on topics including PostgreSQL and open-source technologies.

► Video chapters:
⏩ 00:00 – Music & introduction 
⏩ 03:06 – Common PostgreSQL security blind spots
⏩ 05:45 – SQL injection case study breakdown
⏩ 08:13 – Least privilege and role boundaries
⏩ 10:25 – Schema isolation for safer deployments
⏩ 12:25 – How search_path becomes a security risk
⏩ 15:02 – Exploiting security definer functions
⏩ 18:16 – Protecting data in transit and at rest
⏩ 22:16 – Postgres 17 and 18 security upgrades
⏩ 25:21 – Final security checklist and takeaways

📕 Everything you need to know about POSETTE: An Event for Postgres can be found at: https://posetteconf.com
✅ Learn more:  watch more POSETTE talks: https://aka.ms/posette-playlist

📌 Let’s connect:  
LinkedIn: https://www.linkedin.com/company/posetteconf/
X – @PosetteConf, https://x.com/PosetteConf 
Mastodon – @posetteconf, https://mastodon.social/@posetteconf
Bluesky – @posetteconf.com, https://aka.ms/posette-on-bluesky

#PosetteConf #PostgreSQL #Security

Microsoft Developer

A practical guide to securing PostgreSQL from development to production, covering four key security layers: least privilege role design, schema isolation, search_path hardening to prevent function hijacking, and data protection via TLS and pg_hba.conf configuration. Highlights common security blind spots like overprivileged superuser roles, default public schema access, and missing query auditing. Also covers a 2025 CVE caused by overreliance on escaping APIs instead of prepared statements, and new security enhancements in PostgreSQL 17 (pg_maintain role, safer search_path, incremental backups) and PostgreSQL 18 (OAuth support for external IdP integration).

From Dev to Prod: Securing Postgres the Right Way | POSETTE: An Event for Postgres 2026