i see your point about a server vs sqlite. yes, elasticsearch has a bigger service area than sqlite. i wouldn't necessarily compare it to the mongodb hack though since we're talking about running it locally without exposing a port to the outside vs a cloud hosted db solution. if a malicious user is able to access your local elasticsearch, then there's a good chance they can access your local sqlite instance as well.