I am building a product using hasura that will be used in production. Is it bad practice security wise to publish the repo with all the configuration and structure? Basically all the database migrations and config.
Of course I won't include any keys or sensitive information.
Is this risky?
The question is 100% about security best practices. I don't mind anyone copying or using the code.
If it is not necessary to publish the configuration and structure, I would not do it. If you have a configuration error, it would be very easy for someone to check your configuration and exploit your rules. Configuration can get hairy, and if you make a mistake and document it in a repository, that could open the database up to attack. Even if you are a database expert and have protected against all threats, there could be a new exploit discovered in the future that can take advantage of certain configurations.
Bottom line. A database's first priority is to be secure and prevent loss. This would not improve security and could lead to problems in the future. In my humble opinion, I would not publish your configuration settings.
Check out this article from berkeley.edu for further research:
