# Database Queries / Data Explorer / Source Control / Non-Live Instance?

**URL:** <https://meta.discourse.org/t/database-queries-data-explorer-source-control-non-live-instance/74842>\
**Category:** Product Support\
**Created:** [26 Novembro , 2017 19:44 UTC](https://meta.discourse.org/t/database-queries-data-explorer-source-control-non-live-instance/74842 "2017-11-26T19:44:56Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [26 Novembro , 2017 22:11 UTC](https://meta.discourse.org/t/database-queries-data-explorer-source-control-non-live-instance/74842/4 "2017-11-26T22:11:10Z")

</div>

> [@codinghorror](#):
>
> though cookies get rotated very quickly and the cookie is a hash fingerprint match, not an exact copy of the cookie string.

Just expanding on that, the cookie is a hash of “a secret string” (stored either in environment or Redis) and data in the database. There is no risk that the auth cookie can leak unless environment or redis is exposed as well. If a DB is exposed the biggest risk is that passwords and emails can leak. In particular BAD passwords can potentially be brute force attacked since the salt is stored in the database. Keep in mind though 10 char passwords (which is our minimal default is not that easy to brute force attack)

---

_[View the full topic](https://meta.discourse.org/t/database-queries-data-explorer-source-control-non-live-instance/74842)._