backendgym backendgym — reps Sign in with GitHubSign in
← Reps
PostgreSQL Advanced

SQL · Scaling and security

Read roles, injections, prepared statements, a replica that lags and a shard that runs hot, and say which one your system has.

sql-scaling-and-security / README.md

bgym start sql-scaling-and-security brings up pinned Postgres 16 primary, streaming replica and shard containers, plus a Python app container with psycopg already installed. Nothing is installed on your machine. Write SQL in reps/NN/answer.sql; the injection reps and shard/replica reps use their local run.sh and the file named in their statements. bgym reset removes the replica volume and recreates every database.

You should have finished sql-optimizing and be comfortable reading a transaction and a query result. The statements assume you can look up role grants, prepared statements and connection parameters. The work is to read what an application, replica or routing rule really does.

The main database has bank accounts and a rides app. It is deliberately imperfect: the rides table contains rider names and emails that a public view must hide, the injection scripts receive hostile input, the replica can lag, and the hand-written shard rule sends every key to one server. The app scripts run inside the compose container, so psycopg is not a host dependency.

Do sql-optimizing before this set. This is the last set in the SQL trail.

Reps

In order — each one assumes the ones before it. Open a rep to read it.

  1. 01 01 · Grant the public view
  2. 02 02 · Bind typed values
  3. 03 03 · Judge a login injection
  4. 04 04 · Close a search injection
  5. 05 05 · Read from the replica
  6. 06 06 · Judge a shard hotspot