The application now signs in to the database with limited access
Until today the application connected to its database with a full administrator login. It now uses its own login that can only read and write WBSender's data and nothing else. We also changed the administrator password and removed an administrator account that nobody had used in over a year.
Highlights
- The application has its own database login, limited to WBSender's own data
- That login cannot read the list of database users, create accounts or touch any other database
- The administrator password was changed, and the old one stopped working immediately
- An administrator account unused since June 2025 was removed
- Tested before the switch, including the nightly backup
In this release3
- SecuritySystemHigh impact
A separate, limited database login for the application
The application only ever needs to read and write WBSender's own data. It was signing in with an administrator login that could do far more than that: manage database users, and read or delete any database on the server.
Nothing had gone wrong because of it. But if the application were ever tricked into running something it should not, the damage it could do was the damage an administrator could do.
What we changed:
- Created a new login for the application that can read and write WBSender's database and maintain its indexes, and nothing more.
- Before switching, we signed in as the new login and tried the things it must not be able to do. Reading the list of database users, writing to another database and creating a user were all refused.
- We also ran a full backup as the new login, since the nightly backup uses the same one. It read every record.
- Then we switched the application over and confirmed it was serving requests from the database again.
BeforeThe application signed in as a database administrator, with the power to manage users and to read or delete any database on the server.
AfterThe application signs in with its own login that can only read and write WBSender's data. User management and every other database are refused.
- SecuritySystemHigh impact
Administrator password changed and an unused account removed
With the application moved off the administrator login, we could change that login's password without affecting the service.
What we changed:
- The administrator password was replaced with a new, long, randomly generated one. We checked that the old password is now refused.
- A second administrator account was still on the server. Its last sign in was in June 2025, from the server itself, and nothing uses it. We removed it.
- The administrator login is now only used by our team for maintenance. The running application does not have it.
2 accounts1 account50% lowerDatabase logins with full administrator rights - ImprovedSystem
What you may have noticed
Switching the application to its new login needed one reload of the API, at 17:10 UTC on 10 October.
How it went:
- The API was back within a minute and the linked number that was online reconnected from its stored session.
- Nothing had to be rescanned.
- If a number of yours shows as disconnected since then, open your dashboard once and it reconnects by itself.