Security at Arpe.io
FastBCP, FastTransfer, MigratorXpress, LakeXpress and our ADBC drivers are software you run in your own infrastructure: on-premises, in your cloud tenant or fully air-gapped. This page explains how we build them, what we publish for every release, and how to report a vulnerability.
Your data stays in your infrastructure
Our products are self-hosted executables. There is no Arpe.io-operated service in the data path: you install them, you run them, you control them.
Self-hosted executables
Air-gapped ready
No vendor telemetry
Post-quantum ready
How we build our software
- Source code under version control; releases are built from tagged commits of a dedicated release branch.
- Static code analysis (SonarAnalyzer for C#) as part of the build.
- Every release, including older ones, is scanned for known vulnerabilities in its third-party dependencies with Trivy.
- A software bill of materials (SBOM, CycloneDX) is published for every release.
- Each vulnerability found is assessed for exploitability in our products and the assessment is published (VEX, OpenVEX).
- Published releases are rescanned every week against the latest vulnerability data.
Vulnerability reports by product
FastBCP
High-performance bulk copy tool for exporting SQL Server, PostgreSQL, MySQL and Oracle data to CSV, Parquet, JSON and cloud storage.
FastTransfer
Command-line tool for efficient, high-performance data transfer between database systems.
MigratorXpress
Efficient database migration tool.
LakeXpress
High-performance export of relational databases (PostgreSQL, SQL Server, Oracle, MySQL, MariaDB, SAP HANA) to Parquet, with optional publishing to cloud data platforms.
Methodology
- Dependencies (direct and transitive) are resolved from the source code of each release tag and scanned with Trivy.
- Results reflect the vulnerability database at scan time: an older release may show vulnerabilities disclosed after it was published. Releases are rescanned every week.
- SBOMs are published in CycloneDX format, assessments in OpenVEX format.
- A vulnerability assessed as not affected (the vulnerable code is not reachable in our product) is listed but not counted as open.
Reporting a vulnerability
If you believe you have found a security vulnerability in one of our products, please report it privately to security@arpe.io. Do not open a public issue.
Read our disclosure policy