> How is the security with Fossil? I'm always leery of hosting (niche) web facing services written in C. Fossil's been available for nearly 14 years now and we

> How is the security with Fossil? I'm always leery of hosting (niche) web facing services written in C. Fossil's been available for nearly 14 years now and we've had to make only a single security-relevant release in that time (in late Summer 2020). Fossil's primary architect, Richard Hipp (edit: HN user "SQLite"), is no stranger to code hardening and continues to add security-related APIs to all levels of the code, from how we internally build SQL queries or encode URL arguments to the recent (late 2020) ability for the db to lock down regions of the db until/unless that protection is toggled off for the brief blocks of code which need to modify those regions, ensuring that other areas of the code cannot modify parts of the database which they aren't directly responsible for. Security against malicious inputs has never been treated as an afterthought in fossil.