# \#security

**URL:** https://discourse.getdbt.com/tag/security/81.md

[Latest](https://discourse.getdbt.com/latest.md) · [Categories](https://discourse.getdbt.com/categories.md) · [Tags](https://discourse.getdbt.com/tags.md)

---

## [Is there a recommended approach to do SAST (Static application security testing ) and/or SCA ( software composition testing ) over the dbt code or packages used ?](https://discourse.getdbt.com/t/is-there-a-recommended-approach-to-do-sast-static-application-security-testing-and-or-sca-software-composition-testing-over-the-dbt-code-or-packages-used/20928)

<div class="topic-metadata">

**Author:** [@rakesh.kesavan](https://discourse.getdbt.com/u/rakesh.kesavan)\
**Replies:** 0\
**Last updated:** [August 17, 2026, 9:43am UTC](https://discourse.getdbt.com/t/is-there-a-recommended-approach-to-do-sast-static-application-security-testing-and-or-sca-software-composition-testing-over-the-dbt-code-or-packages-used/20928 "2026-08-17T09:43:45Z")

</div>

For large scale use of dbt cloud , it will be important to have automatic way to test the code for security vulnerabilities in code and also in the packages used , is there is a recommended approach here ?

---

## [Production Credentials](https://discourse.getdbt.com/t/production-credentials/5947)

<div class="topic-metadata">

**Author:** [@fernando.amaral](https://discourse.getdbt.com/u/fernando.amaral)\
**Replies:** 3\
**Last updated:** [April 9, 2024, 2:19pm UTC](https://discourse.getdbt.com/t/production-credentials/5947 "2024-04-09T14:19:54Z")

</div>

Hi! Using dbt Cloud with Team license. A project should have different development and production database credentials. But a developer can go to the production environment and see production database credentials. My…

---

## [Tightening up security when using dbt-core with GitHub actions](https://discourse.getdbt.com/t/tightening-up-security-when-using-dbt-core-with-github-actions/7258)

<div class="topic-metadata">

**Author:** [@kevin.mcisaac](https://discourse.getdbt.com/u/kevin.mcisaac)\
**Replies:** 1\
**Last updated:** [March 14, 2023, 8:41am UTC](https://discourse.getdbt.com/t/tightening-up-security-when-using-dbt-core-with-github-actions/7258 "2023-03-14T08:41:55Z")

</div>

The problem I’m having We want to use GitHub actions to schedule dbt (i.e., dbt run ) but we don’t want to allow other (non dbt) steps in the action to access our database. What I’ve already tried We’ve implemented thi…

---

## [Does dbt Cloud store any source data?](https://discourse.getdbt.com/t/does-dbt-cloud-store-any-source-data/720)

<div class="topic-metadata">

**Author:** [@johnoscott](https://discourse.getdbt.com/u/johnoscott)\
**Replies:** 4\
**Last updated:** [September 27, 2022, 11:59pm UTC](https://discourse.getdbt.com/t/does-dbt-cloud-store-any-source-data/720 "2022-09-27T23:59:26Z")

</div>

Does DBT Cloud store any of my warehouse source data ? I expect the answer is NO since DBT just runs queries against the source - but I just want to check. What I am really asking is there any data governance risk in usi…