Skip to content

Security & networking

Manage authentication, privacy, encryption, and tunnels.

8 extensions

Secure remote secrets storage with OPAQUE PAKE authentication, email/password registration, MFA login, and automatic ducklake mounting

Haybarn 1.5.5Linux · macOS · WASM · Windows

Reach any TCP service from DuckDB through an SSH bastion, Tailscale or NetBird — and publish local ports back onto those networks.

Haybarn 1.5.5Linux · macOS · Windows

Validate, decode, and extract OAST (Out-of-Band Application Security Testing) domains in SQL

Haybarn 1.5.5Linux · macOS · WASM · Windows

Automatic query privatization using the PAC Privacy framework

Haybarn 1.5.5Linux · macOS · WASM · Windows

Enforces table-level access control via an allowlist mechanism, blocking queries to unauthorized tables with a PermissionException

Haybarn 1.5.5Linux · macOS · Windows

Availability checked September 9, 2026. WASM availability means a binary is published; individual features may require a native environment.