---
title: Database And Cache Security
url: "/docs/databases/security/"
canonical_url: https://docs.blossom88.com/docs/databases/security/
markdown_url: https://docs.blossom88.com/docs/databases/security.md
summary: Private connectivity and credential handling for Databases and Caches
categories:
- data
- databases
- caches
- security
---

# Database And Cache Security

Blossom Databases and Caches have stable private endpoints available to linked
Apps. Their ports are not public application endpoints. Always use the
Blossom-provided connection URL rather than a provider address or Container
name.

## Stable Private Endpoints

Database and Cache endpoints use stable Blossom resource ids:

```text
database-abc123.blossom.internal
cache-def456.blossom.internal
```

Blossom keeps private DNS current during recovery and standby promotion.
Applications retain the same primary hostname through those changes.

## Environment Links

Use an Environment Link to deliver a connection URL to every Service in an
Environment:

```yaml
environment_link:
  environment_id: environment-100
  target_type: DatabaseInstance
  target_id: database_instance-100
  var_name: DATABASE_URL
```

The target and Environment must belong to the same Account and region. Redis
defaults to `REDIS_URL`, Memcached defaults to `MEMCACHED_URL`, and Database
engines default to `DATABASE_URL`.

## Credentials

Blossom generates Database and Redis credentials and includes them only in the
resolved Environment variable or an authorized console session. Passwords and
backup-storage secrets are encrypted at rest and redacted from API responses,
Activities, and logs.

Do not place connection URLs in source control or copy them into Service
configuration. Keep the Environment Link as the source of the connection
variable so dependent Services receive the same private endpoint and
credentials.

## Memcached

Memcached has no native authentication. Its private endpoint is the security
boundary. Never expose port `11211` publicly or route it through an application
load balancer.

- [Databases](/docs/databases/)
- [Caches](/docs/caches/)