Does elementary have any documentation, certifications, audits, blogs, web pages or whatsoever about security? At a big organization we are already using dbt core, however having a hard time to get elementary through, because it is yet another dependency. Currently we are only allowed to use anything which is part of dbt-labs. We are already scanning container images we create for our dbt project with Prisma, however that has no support for scanning dbt dependencies (which makes sense, because it is kind of a niche in the broader sense of container images). I would really like to implement elementary, because I think it is a fantastic addition on top of the dbt artifacts for monitoring your dbt tests etc. So any documents about how elementary handles security, or any other tips on gettings this through might really help!

Hey @Ramon Vermeulen, interesting question! We have SOC 2 type II certification and we provide security documentation and audit info but only to our cloud customers (I believe dbt labs do the same...). You can read about it here. As our cloud product uses the dbt package and some of the CLI code, our security audit included a review of these products as well. Generally speaking about dbt packages - In developing a dbt package we are limited only to the functionality that dbt-core exposes. For example - A dbt package can't create files, execute files, access files, initiate network sessions, etc. It can execute SQL queries as part of your dbt invocations, with the permissions given to dbt core. Hope this helps!

Thanks btw, this helps! 🙂