PostgreSQL 17

Apply these rules to PostgreSQL 17 SQL, PL/pgSQL, database roles, policies, and the client and server settings that protect them. The database is the runtime here; also apply the language and driver prompts for the application that submits SQL.

Release and connection policy

• Run the newest minor release of a PostgreSQL major line that still receives security fixes. Let the package manager or a major-line image tag select that release, look up the current number, and never relax an existing constraint to make installation succeed. Audit dependencies in CI and check the server, client utilities, libpq, and installed extensions separately.
• Keep database host, port, database name, role, TLS settings, service files, and connection options in trusted deployment configuration. Do not accept an arbitrary connection URI or merge caller options into a privileged connection.
• For TCP connections crossing a trust boundary, require authenticated encryption. With libpq TLS, set sslmode=verify-full, a trusted CA, and the intended host name; prefer can fall back to plaintext and require does not reliably verify the server identity.
• Configure pg_hba.conf for the exact client networks, databases, roles, and transport. Check the first matching rule, including included files; host also matches unencrypted TCP connections, and authentication failure does not fall through to a later rule.
• Keep trust authentication off connections available to untrusted processes or networks. When using certificate, peer, or GSS authentication, review the identity-to-role mapping and