Skip to content

[SAR] APPENG-5148: Block SQLite in Cloud Run production#198

Open
yuvalk wants to merge 1 commit into
RHEcosystemAppEng:mainfrom
yuvalk:fix/APPENG-5148-sqlite-production-guard
Open

[SAR] APPENG-5148: Block SQLite in Cloud Run production#198
yuvalk wants to merge 1 commit into
RHEcosystemAppEng:mainfrom
yuvalk:fix/APPENG-5148-sqlite-production-guard

Conversation

@yuvalk
Copy link
Copy Markdown
Collaborator

@yuvalk yuvalk commented May 6, 2026

Summary

Addresses APPENG-5148.

Adds a startup guard that prevents SQLite database URLs from being used in Cloud Run production. SQLite lacks concurrent access support and data is lost on container restarts, making it unsuitable for production workloads.

Changes

  • Added _block_sqlite_in_production model validator in src/lightspeed_agent/config/settings.py that raises ValueError when SQLite is used with K_SERVICE set

SAR Reference

  • CWE: CWE-1188 (Initialization with an Insecure Default)
  • Impact: Medium

Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com

Add a model validator that prevents SQLite database URLs when running
in Cloud Run (detected via K_SERVICE environment variable). SQLite is
unsuitable for production as it lacks concurrent access support and
data is lost on container restarts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant