# Security Overview > How API Maker keeps your data safe - every API locked by default, the API gate and the row gate, what is enforced where, the trust model of the sandboxes, what the licence check sends, and the checklist before you go live. Source: https://docs.apimaker.dev/v4/docs/security/overview.html Every API of API Maker is locked until you open it, and two gates decide who reaches what : groups decide **which APIs**, a pre hook decides **which rows**. The [security report](https://docs.apimaker.dev/v4/docs/apis-security/api-security-report.html) reads your settings and your code, and says where the second gate is missing. ## Locked by default | Part | How it is locked | |---|---| | Database and custom APIs | A call needs the token of an [API user](https://docs.apimaker.dev/v4/docs/apis-security/api-user-permission.html) whose groups grant that API. Only the APIs you mark `IS_PUBLIC` in their [settings](https://docs.apimaker.dev/v4/docs/settings/apiSettings.html) skip it. | | System APIs | Closed over HTTP : your code calls them, an HTTP call answers `401` until a [system API setting](https://docs.apimaker.dev/v4/docs/settings/systemApiSettings.html) opens it. The token API is the exception. | | Fields | A group grants read and write per field : a field it does not grant is absent from the answer. | | Secrets | Keys and connection strings live in the [secret](https://docs.apimaker.dev/v4/docs/secrets/secrets.html), encrypted on the server and never in Git. Each account gets keys of its own. | A new account starts open for its first steps : an API user `default` with the password `12345`, and a group `Default` which grants everything. Replace both before real data arrives : see [Before you go live](https://docs.apimaker.dev/v4/docs/security/go-live.html). ## Two gates ![The API gate and the row gate](https://docs.apimaker.dev/assets/images/role-based-permissions/rbac-two-gates.svg) - **The API gate : who may call which API.** The application sends the token of its API user (`x-am-authorization`) ; its [groups](https://docs.apimaker.dev/v4/docs/apis-security/api-group-permission.html) grant APIs, tables and fields. A person sends a token of their own (`x-am-user-authorization`), made by an [auth provider](https://docs.apimaker.dev/v4/docs/authorization/AMDB.html) ; their groups must grant the API too. - **The row gate : which rows that person reaches.** Groups can not know that order 1042 belongs to Ada : that is a fact of the data. A [pre hook](https://docs.apimaker.dev/v4/docs/apis-all/hooks/preHook-api.html#narrow-a-request-to-the-rows-of-the-caller) adds the owner to every filter and stamps it on every write. The security report installs it in one click. > Diagram : The row gate : the same call, without and with the row scoping pre hook > > Without a row scoping pre hook, Diya calling get all on orders gets every order of the table, hers and Kabir's. With the hook, API Maker adds her customer id to the filter with $and before the query runs, and she gets only her two orders. [Handle role based permissions](https://docs.apimaker.dev/v4/docs/authorization/handle-role-based-permissions.html) builds both gates step by step, and tries to break them. ## What is checked where | Question | Answered by | Page | |---|---|---| | Is the caller an application we know ? | The token of an API user | [API users](https://docs.apimaker.dev/v4/docs/apis-security/api-user-permission.html) | | Which person is it ? | The token of an auth provider | [Auth providers](https://docs.apimaker.dev/v4/docs/authorization/AMDB.html) | | May they call this API, read this field ? | Groups | [Groups](https://docs.apimaker.dev/v4/docs/apis-security/api-group-permission.html) | | Is this row theirs ? | A pre hook | [Pre hooks](https://docs.apimaker.dev/v4/docs/apis-all/hooks/preHook-api.html) | | Is this data valid ? | The schema of the table | [Schema](https://docs.apimaker.dev/v4/docs/schema/schema.html) | | Where is a leak ? | The security report | [Security report](https://docs.apimaker.dev/v4/docs/apis-security/api-security-report.html) | | From which web sites ? | Allowed origins | [Security features](https://docs.apimaker.dev/v4/docs/features/security-features.html#allowed-origins) | ## The sandboxes : what they protect, and what they do not The code of an account (custom APIs, hooks, schedulers, events) runs in Docker containers of that account, apart from the process of API Maker, with a [time limit](https://docs.apimaker.dev/v4/docs/settings/sandboxSettings.html#time-of-a-run). They keep API Maker running when code fails : an exception ends its request with an error, and code which runs too long is cut short while a new runner takes the next requests. > Diagram : Where code runs : sandboxes per account and language, and the native process > > One API Maker process per server hands the code of each account to the sandboxes of that account : Docker containers, one kind per language, more of them while they are busy, up to the sandbox count. Code marked runOnNativeProcess runs on the machine instead, beside API Maker. The containers run privileged and without a memory limit : they guard against faulty code, not against hostile code. They are not a wall against hostile code : - **The containers run privileged.** Code which wants to can reach the server around them, and from there the secrets of every account of the server. - **They have no memory limit.** A leak takes memory of the whole server. - **The native process is not isolated at all.** Code with `runOnNativeProcess: true` runs on the machine of the server, beside API Maker. So run on one server only code you trust : your team's, or an AI's that your team reviewed. **For clients who must not see each other's data, use separate servers**, not separate accounts of one server. ## What API Maker sends to us API Maker has no analytics. A server checks its licence key with the licence server of API Maker (`sava.be.apimaker.dev`), and sends nothing else : | | | |---|---| | What it sends | The licence key, the MAC addresses of the machine and its number of CPU cores. | | When | A minute or two after it starts, every day at about 12:00 (time of India), every four hours while a check gets no answer, and when a key is written. | | What it never sends | Data of your databases, your APIs, logs, code or users. | | What a failed check does | Nothing to your APIs : the licence page of the admin panel shows the problem. A licence server which does not answer changes nothing. | | The key of API Maker Launchpad | Never sent : the licence page shows `LOCAL`. | ## Before you go live The [checklist](https://docs.apimaker.dev/v4/docs/security/go-live.html) : default passwords, the default group, the row gate, public APIs, HTTPS, backups. ## Report a vulnerability Write to [contact@apimaker.dev](mailto:contact@apimaker.dev) with the steps to reproduce it. Please give us time to fix it before you publish.