iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Detecting sensitive-data exposure in Metabase requires testing the complete path from a person and their groups, through Metabase permissions and sharing features, to the database account that actually runs the query. The safest approach is to inventory sensitive assets, reduce additive group access, lock down each database connection, configure the isolation method that matches your tenant layout, and then test as the affected user in a private session. Logs and Monitor help investigate, but only a user-level test confirms what a person can actually open, query, download, or receive.
What counts as sensitive data exposure in Metabase?
Exposure is not limited to an obviously public dashboard. It includes any case where a person receives data outside the people, rows, columns, tenants, or business purpose they are supposed to see. A user may have the right to open a question but still receive too many rows; a dashboard filter may appear to select one tenant while the underlying SQL can return others; or a shared link may bypass the normal sign-in path.
Metabase permissions are one layer in a chain. A practical model is:
- Identity and group membership: which Metabase groups contain the person?
- Metabase data permissions: which databases, schemas, tables, and fields can those groups view or query?
- Collection permissions: which questions, models, dashboards, and SQL cards can the groups open or edit?
- Sharing and execution paths: can a public link, subscription, alert, embedded dashboard, download, or SQL editor expose the result?
- Database authorization: which database principal does the Metabase connection use, and what can that principal read?
The effective result is the intersection of technical controls and the broadest path that remains available. A restrictive setting in one layer does not prove that the whole path is restrictive.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Metabase’s permissions introduction explains that permissions are granted to groups, people may belong to multiple groups, and the most permissive grant takes effect. That additive behavior is the first issue to test.
Start with an exposure inventory
Before changing permissions, make a written inventory. Include the assets that contain or can derive sensitive information, not only the tables that are marked confidential.
- Production and analytical databases, including replicas and warehouses.
- Schemas, tables, views, models, and fields containing personal, financial, health, credential, or tenant-isolated data.
- Questions, models, native SQL cards, dashboards, pulses, alerts, and subscriptions that reference those assets.
- Collections and nested collections where the content is stored.
- Public links, guest embeds, signed embeds, API clients, downloads, and scheduled deliveries.
- The teams, roles, and tenant groups that should see each asset, row set, or column.
Record the intended audience in terms that can be tested: for example, a support analyst may see order status for assigned customers but not payment details, while a tenant administrator may see only rows whose tenant identifier matches their account. This statement becomes the expected result for your validation tests.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMap data to an owner
Assign an owner for every sensitive database and collection. The owner should be able to answer why a field is exposed, which groups need it, and how quickly access must be revoked when a person changes teams. Unowned collections and old SQL questions are common places for inherited access to survive.
Review additive Metabase permissions
Open Admin settings > Permissions and inspect both group membership and group grants. Looking only at a person’s job group can miss access inherited from another group.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Check the All Users group first
Every Metabase account belongs to All Users by default. If that group can view a database, schema, table, collection, or question, a narrower group restriction cannot take the access away. Remove unintended grants from All Users before adding selective grants to role or tenant groups. Then inspect direct membership and nested or department groups for every affected person.
Review data and collection permissions together
Data permissions govern what can be queried; collection permissions govern which saved content can be opened, changed, or shared. A person may have no permission to browse a table yet still be able to open a dashboard whose cards run against it, depending on the connection and content permissions. Conversely, hiding a collection does not reduce what a broad database connection can return through another question.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteUse the data permissions documentation as the reference for the deployed version. Capture the resulting access for each group instead of relying on screenshots: permissions change over time, and additive grants make visual inspection easy to misread.
Do not infer safety from Open Source behavior
Plan capability matters. Metabase’s self-hosted security guidance states: “Open Source: View data cannot be restricted by Metabase group; Can view is fixed.” Granular View data controls and row-and-column security are Pro or Enterprise features. Confirm the exact edition and version you run; the documentation navigation currently identifies version 0.64, but availability can change.
Verify the database account behind every connection
Metabase still connects to a database as a database principal. Database grants are evaluated before Metabase data and collection permissions, so an overpowered connection account is an exposure risk even when the Metabase UI appears restrictive.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Identify the principal and its grants
- For each Metabase database, record the host, database name, schemas, and the username or role configured in the connection.
- Ask the database administrator to show that principal’s effective grants, including inherited roles, default privileges, views, functions, and cross-schema access.
- Test the grants directly in the database with representative
SELECToperations. Check whether metadata queries reveal object names or columns that should remain confidential. - Remove access to unused schemas and tables. Grant only the read operations needed for analytics; avoid write, DDL, administrative, and broad catalog privileges.
- Create a dedicated read-only account for Metabase rather than reusing an application owner, migration role, or personal account.
Metabase’s self-hosting security best practices recommends dedicated users with access limited to the schemas and tables required. Database restrictions are a backstop for every Metabase path, including SQL questions and accidental permission grants.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Recheck after schema changes
New tables, views, and default privileges can silently broaden a role. Include the Metabase principal in migration reviews and schedule a periodic grant diff. Treat a newly visible column as a change requiring the same owner approval as a new dashboard.
Choose an isolation method that fits the data layout
Metabase documents several data isolation methods. The right choice depends on whether tenants share tables and how strongly the database must enforce the boundary.
| Data layout or use case | Primary option | Where rules are enforced | Important limitation |
|---|---|---|---|
| Many tenants in shared tables | Metabase row and column security | Metabase policy tied to groups and user attributes | Pro or Enterprise feature; SQL and public-sharing paths require separate review. |
| Many tenants in shared tables with database-level enforcement | Database impersonation | Database roles or session identity | Requires database configuration and careful connection-role management. |
| Each tenant in a separate database | Database routing | Connection selection based on the user or tenant context | Routing configuration and every destination database must be governed. |
| Guest or embedded dashboards | Locked parameters as a presentation control | Embed filter state | Do not treat locked parameters as the security boundary for sensitive data. |
Row and column security
Row and column security can restrict rows or hide fields according to group membership and user attributes. Follow the row and column security documentation for the deployed release. Verify that each person has the expected attribute value, that the policy is assigned to the intended group, and that another group does not grant a conflicting or broader policy.
Test native questions, models, dashboard cards, downloads, alerts, and subscriptions separately. A policy that behaves as expected in the query builder does not automatically prove that every delivery mechanism has the same result. Review collections containing sensitive SQL questions in particular. SQL access and public sharing can provide paths where row-and-column protections do not apply as you expect.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Database impersonation
Impersonation moves the tenant decision into database roles or session identity. It is a strong fit when the database team must enforce the boundary independently of Metabase, but it increases the number of roles, mappings, and connection behaviors that must be operated. Test role switching, connection pooling, and failure behavior before relying on it for production isolation.
Database routing
Routing is designed for separate tenant databases. Verify that an authenticated user can reach only the intended destination, that a missing or malformed tenant attribute fails closed, and that saved questions do not contain a fixed connection that bypasses routing. Apply the same read-only principle to every tenant database account.
Close sharing, SQL, and embed escape paths
Review every way a result can leave the normal interactive screen:
- Public links: disable public sharing for sensitive questions and dashboards unless the content is intentionally public. Test an unauthenticated browser, not only an administrator’s session.
- SQL questions: identify who can create, edit, and run native SQL. Restrict sensitive SQL cards to collections with tightly controlled access, and examine whether the connection account can read more than the card displays.
- Downloads: test CSV, JSON, and spreadsheet downloads as the affected user. A dashboard that visually hides a column may still offer a download path with different fields.
- Alerts and subscriptions: check recipients, schedule ownership, and the query result delivered. Remove former employees and broad mailing lists.
- Embeds: a locked filter parameter can hide and lock a filter, but it is not a reliable authorization boundary for sensitive records. Enforce isolation with row policies, impersonation, routing, or database grants.
- API and automation: inventory service accounts, tokens, and scripts that call Metabase. Apply the same group and database-principal review to non-human identities.
Validate what a person can actually see
Permission inspection predicts access; user-level testing confirms it. Metabase’s data-permission troubleshooting guidance recommends signing in as the person whose access is being checked.
- Choose a representative user from each sensitive role, including a user with multiple group memberships and one whose access was recently changed.
- Open an incognito or private browser session and sign in as that user. Do not use an administrator session with impersonation unless the product version explicitly provides an equivalent test.
- Open the actual dashboard and each sensitive question. Record whether the user can view, drill through, edit, duplicate, download, or share it.
- Run boundary tests: a permitted tenant, a neighboring tenant, an unauthorized field, an empty result, and a malformed or missing user attribute.
- Try relevant SQL, public-link, embed, alert, subscription, and API paths. Check the delivered payload, not just the on-screen chart.
- Compare the observed rows and columns with the inventory’s expected audience. Save the test time, account, group memberships, connection, question identifier, and result.
- After remediation, repeat the same tests and retain evidence that the former path now fails or returns only the approved data.
Use fail-closed expectations
A missing tenant attribute, unavailable policy, or routing error should produce no sensitive rows or an explicit authorization failure. If an error instead returns all rows, treat it as a high-priority defect. Test both normal and degraded conditions, such as a deleted group, expired account, or unavailable identity provider.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Use logs and Monitor as investigation aids
Centralize Metabase application logs, database audit logs, and reverse-proxy or load-balancer logs. Correlate user identity, timestamp, source address, question or dashboard identifier, database connection, and rows or export action where your systems record them.
Use logs to answer what happened after a suspected exposure: who opened the content, which query ran, which connection executed it, and whether a download or scheduled delivery followed. Metabase’s Monitor features can help surface activity and health signals, but some Monitor functionality is plan-dependent and neither Monitor pages nor logs prove that every access path was covered. Keep retention, access to logs, and alerting rules under the same governance as the data they describe.
Protect self-hosted secrets and the deployment
For self-hosted Metabase, protect encryption and session keys as production secrets. Keep the same key pair across all nodes in a clustered deployment so sessions and encrypted values remain valid, and preserve the encryption key separately with a tested recovery procedure. A lost or inconsistent key can prevent recovery or cause unexpected session behavior.
Recommended Free Tools
- Store keys in a secret manager or equivalent protected mechanism, not in source control or shared tickets.
- Limit who can read, rotate, or export them, and document the rotation and recovery process.
- Restrict administrative access to Metabase, the database, and the proxy tier; require strong authentication for operators.
- Terminate TLS correctly at the edge and verify encryption between tiers where sensitive traffic crosses networks. Metabase’s hosted security page describes its own service practices, including TLS 1.2 or higher; those statements do not automatically describe a self-hosted deployment.
Keep the installation on a supported release and review Metabase security advisories and hardening guidance promptly. Record the deployed version, edition, extensions, reverse-proxy configuration, and database drivers so an upgrade can be assessed rather than applied blindly.
A repeatable review schedule
| When | Checks | Evidence to retain |
|---|---|---|
| Before launch or a major data change | Inventory assets, approve intended audiences, review group and database grants, and test representative users. | Permission export, database grant report, test cases, and owner approval. |
| After a role or tenant change | Remove old group membership, re-test dashboards and downloads, and verify alerts and subscriptions. | Change ticket and before/after user-level results. |
| Monthly or on a risk-based cadence | Review All Users, privileged groups, public links, SQL collections, service accounts, and database grant drift. | Signed review record and exceptions with expiry dates. |
| After an incident or security advisory | Preserve logs, revoke exposed links or tokens, rotate affected secrets, patch, and repeat boundary tests. | Timeline, containment actions, remediation evidence, and lessons learned. |
Incident response when exposure is suspected
- Contain: disable public links, revoke exposed tokens, remove unintended group grants, and pause affected subscriptions or alerts.
- Preserve: export relevant Metabase, database, and proxy logs before retention rules overwrite them.
- Scope: identify the question, dashboard, connection, principal, users, time window, and fields that could have been returned.
- Correct: reduce database grants, repair group or policy assignments, rotate secrets where necessary, and patch the deployment.
- Verify: repeat private-session tests for every affected role and path, including downloads and automation.
- Govern: document notification and regulatory decisions with your incident-response and privacy owners.
This process separates a visible symptom, such as an unexpectedly open dashboard, from the full scope of data that the underlying connection or SQL path could have returned.
Quick Recap
Practical control checklist
- Every sensitive database, schema, table, field, question, dashboard, and collection has an owner and intended audience.
- All Users has no unintended access, and every affected person’s complete group membership has been reviewed.
- Data permissions and collection permissions have been evaluated together.
- Each connection uses a dedicated read-only database principal limited to required schemas and tables.
- The chosen isolation method matches shared-table or separate-database architecture.
- Row and column policies include tested user attributes and no broader conflicting group grant.
- Sensitive SQL collections, public links, embeds, downloads, alerts, subscriptions, and APIs have explicit approvals.
- Representative users have been tested in private sessions, including unauthorized tenant and column cases.
- Metabase, database, and proxy logs are centralized with controlled access and suitable retention.
- Encryption and session keys are secret, consistent across nodes, separately recoverable, and covered by a tested plan.
- The deployed edition and version are supported, and security advisories are reviewed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
