# How safe is a closed category?

**URL:** https://meta.discourse.org/t/how-safe-is-a-closed-category/152190
**Category:** Support
**Created:** [21 mei 2020 om 08:23 UTC](https://meta.discourse.org/t/how-safe-is-a-closed-category/152190 "2020-05-21T08:23:35Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![albtuz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/albtuz/32/181220_2.png) [@albtuz](https://meta.discourse.org/u/albtuz)
#### Post date: [21 mei 2020 om 08:23 UTC](https://meta.discourse.org/t/how-safe-is-a-closed-category/152190/1 "2020-05-21T08:23:35Z")

</div>

Say that I have a category _A_ where only a certain group _X_ has _Create / Reply / See_ access.

This might sound stupid but I must ask, sorry for my ignorance.

Can sensitive topics be held within _A_ by _X_ members with 100% certainty that no users out of _X_ may have access in any way to those topics?

Have you experienced any way to hack through a category security?

---

<div class="post-metadata">

### Author: ![Thomas\_G](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/thomas_g/32/200158_2.png) [@Thomas\_G](https://meta.discourse.org/u/Thomas_G)
#### Post date: [21 mei 2020 om 08:32 UTC](https://meta.discourse.org/t/how-safe-is-a-closed-category/152190/2 "2020-05-21T08:32:05Z")

</div>

There is no way someone else, except from group A, to see the closed category.

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [21 mei 2020 om 09:22 UTC](https://meta.discourse.org/t/how-safe-is-a-closed-category/152190/3 "2020-05-21T09:22:07Z")

</div>

Or an administrator.

They can always see **everything**.

---

<div class="post-metadata">

### Author: ![EricGT](https://avatars.discourse-cdn.com/v4/letter/e/f1d935/32.png) [@EricGT](https://meta.discourse.org/u/EricGT)
#### Post date: [21 mei 2020 om 09:53 UTC](https://meta.discourse.org/t/how-safe-is-a-closed-category/152190/4 "2020-05-21T09:53:17Z")

</div>

Post are stored in the database and Discourse is using PostgreSQL as the software that runs the database.

So the following statements relate to access that starts from there.

Since the database is a set of files anyone who has OS level access, e.g. bash prompt, and access to the files making up the database has access.

Anyone who has a dump of the database has access.

Anyone who has access to the backup files. The backup files might have additional builtin protections that limit the access, but one needs to check that, e.g the backup system encrypts the files during backup.

---

<div class="post-metadata">

### Author: ![Stephen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/stephen/32/95011_2.png) [@Stephen](https://meta.discourse.org/u/Stephen)
#### Post date: [21 mei 2020 om 09:55 UTC](https://meta.discourse.org/t/how-safe-is-a-closed-category/152190/5 "2020-05-21T09:55:57Z")

</div>

As @albtuz appears to be a CDCK customer, much of that access isn’t available.
