<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Database Security Audit — API Reference

## Audit Database Configuration

```bash
node scripts/agent.js --action audit --dbtype postgresql --config /etc/postgresql/16/main/postgresql.conf
node scripts/agent.js --action audit --dbtype mysql --config /etc/mysql/my.cnf
```

## Analyze Permissions

```bash
node scripts/agent.js --action permissions --input /tmp/pg_roles.json
```

## Generate Compliance Report

```bash
node scripts/agent.js --action report --input /tmp/db_audit.json --framework cis
```

## Security Checks — PostgreSQL

| Check | Setting | Expected | CIS |
|-------|---------|----------|-----|
| ssl | ssl | on | 3.1 |
| password_encryption | password_encryption | scram-sha-256 | 5.2 |
| log_connections | log_connections | on | 8.2 |
| log_statement | log_statement | ddl | 8.2 |
| listen_addresses | listen_addresses | localhost | 9.2 |

## Output Format

```json
{
  "check": "ssl",
  "setting": "ssl",
  "expected": "on",
  "current": "off",
  "compliant": false,
  "severity": "critical",
  "cis_control": "3.1"
}
```

## Permission Analysis Output

```json
{
  "role": "backup_user",
  "issues": ["superuser privilege — minimize these accounts"],
  "severity": "critical"
}
```
