// TECHNOLOGIES / POSTGRESQL

PostgreSQL

PostgreSQL, confirmed by its own protocol.

Most scanners tell you port 5432 is open. That is not a finding, and it is often not even PostgreSQL. NewScan speaks the PostgreSQL v3 startup protocol: an SSLRequest answered S or N, then a well-formed reply to one minimal StartupMessage. Only after both does anything record — so you learn whether TLS is available, which authentication method the server actually demands, and whether a trust rule lets anyone in without a password.

▸ Run the free scan ← All technologies

The dashboard blind-spot

// why an external scan matters

// THE DASHBOARD SHOWS (WHAT YOU CONFIGURED)

The pg_hba.conf you wrote, the postgresql.conf you deployed, and the roles in your catalog — as configured, on the host you configured them on.

// IT CAN'T SEE (NEWSCAN DOES)

Whether the server answers from where an attacker actually stands, whether it can negotiate TLS at all, which authentication method it demands in practice, and whether a .pgpass, a config file or a full pg_dump is being served over HTTP by the app in front of it.

What NewScan records

// proven, then reproduced

Passwordless (trust) authentication

CRITICAL

The server returns AuthenticationOk for a single named role with no password supplied. Anyone who can open a TCP connection is already authenticated. Active profile only, one role, no query, no credential list.

Exposed pg_hba.conf with a non-local trust rule

CRITICAL

The client-authentication file served over HTTP containing a trust method for a non-loopback range — which also tells an attacker exactly which address to come from.

Exposed PostgreSQL dump

CRITICAL

A response carrying pg_dump's own header and preamble — the schema, and in a plain dump the table data with it.

Networked service, no TLS, or legacy MD5

MEDIUM / LOW

A database reachable beyond loopback; an SSLRequest answered N where traffic crosses a network; or md5 requested where SCRAM should be. The last is posture, recorded as an observation.

What is never flagged

// the false-positive contract

A scanner earns its place by what it stays quiet about. These are guarantees, each one asserted by a test that fails the build if it regresses — not best-effort tuning.

An open port

A generic TCP service, an HTTP server on 5432, or a port that merely accepts a connection is reported as unconfirmed — which is the correct answer, not a miss.

A loopback-only trust rule

The normal local-development default. Only a non-local trust rule fires.

A guessed version

A version is recorded only when the server itself supplies one through a verified protocol path. It is never inferred from a banner or a port.

PgBouncer, Patroni or TimescaleDB

They never inherit a PostgreSQL finding from port 5432; each needs its own confirmed signature.

How it's proved

// training/tech/postgresql

Real PostgreSQL 16.3, pinned by digest, in three postures — legacy md5, a correctly configured SCRAM + TLS control, and a labelled trust service — plus static fixtures paired with marker-free look-alikes. The control must score zero.

// FINGERPRINT FIRST

The check is silent unless the product is confirmed by two independent signals. A single, spoofable marker confirms nothing.

// REPRODUCE BEFORE RECORD

Every finding is re-run by our own detector before it is written down. A model's self-assessment is discarded, not merged.

// SEVERITY THAT MAPS

One calibrated severity per finding, translated into PCI DSS, SOC 2, ISO 27001, HITRUST, HIPAA and NIST 800-53 ratings with remediation SLAs.

Run it against your own PostgreSQL

NewScan is free and self-hosted — bring your own key. Every check on this page runs in the deterministic floor with no model and no provider key at all, so scanning your own PostgreSQL surface is local to you and depends on no hosted resource.

Get NewScan (FREE) → Talk through your results