Security you can understand.
Native encryption is part of the setup.
Understanding its limits is part of building responsibly.
Encrypted on disk.
The custom native engine protects live WiredTiger blocks, journals and MongoDB temporary spill files using XChaCha20-Poly1305.
Authenticated locally.
Loopback-only binding, mutual TLS and SCRAM-SHA-256 protect the connection between your application and its engine.
Keys stay personal.
A random key per store and Windows DPAPI CurrentUser protect the vault. No vendor master key is built into the SDK.
Behind the simple API.
The SDK manages the port, certificates, protected vault and a rotating readWrite application account. Raw data keys enter the engine through a bounded stdin frame, not through command-line arguments, environment variables or plaintext key files.
| Layer | Mechanism |
|---|---|
| Live storage | libsodium 1.0.22 · XChaCha20-Poly1305 · independent random 256-bit store key |
| Connection | 127.0.0.1 · automatic port · mutual TLS · SCRAM-SHA-256 |
| Windows vault | DPAPI CurrentUser + private filesystem permissions |
| Diagnostics | Bounded authenticated AES-256-GCM records for native process logs |
| Backups | Stopped-store authenticated AES-256-GCM archives with a separate password |
Evidence you can inspect.
Actual Windows tests covered encrypted records and journals, real aggregation spills, wrong-key refusal, authenticated connections, backups, migration, parent-exit cleanup and isolated single-file consumers. Test groups overlap; they do not establish an independent audit.
Inspect the matching Windows run →Know the boundaries.
MongoDB 4.0 is end-of-life. BsonLite does not provide upstream server maintenance, an independent security audit or anti-rollback protection. Compromised runtimes, same-account malware, administrators, memory scraping, pagefiles, hibernation and OS crash dumps are outside live-file encryption protection.
Clean Windows Home/Pro, packaged desktop apps, cross-PC restore and power-loss/disk-full behavior remain additional release validation. The custom engine disables its own minidump writer, but that does not disable all operating-system or Node crash mechanisms.
Application authorization still belongs to your app. Keep desktop database access in a trusted backend or main process and validate the operations exposed to the user interface.
Report a security concern