How to block the STORE statement for users using Binary Load?(QLIK CLOUD)
Hi everyone,
I am facing a critical security concern regarding Section Access and Binary Loads, and I would like to know if there is a way to prevent it.
The Scenario: I have a base application with Section Access properly applied to restrict data visibility. Another developer user consumes this app's data model using a Binary Load.
The Problem: The issue happens when this developer uses the STORE statement in their script to export the loaded tables into QVD or TXT files. The exported files are created without any access restrictions. The Section Access rules are completely bypassed in the stored data.
The Security Concern: Because of this behavior, a developer can easily extract restricted data into unrestricted files. I consider this a severe security risk and data leakage problem, and I am very concerned about the platform's data governance in this scenario.
My Questions:
Is there any way to block, disable, or restrict the use of the STORE command for developers who are using a Binary Load?
Are there any configurations, security rules, or best practices at the QMC/Tenant level to prevent this specific type of data extraction?
I understand that we could segregate access using Spaces. However, these developers need to access the data spaces to perform the Binary Load and consume the data model. Even if we restrict their write access to corporate Shared/Data Spaces, they might still be able to STORE the data into their Personal Spaces. How do you handle this architectural dilemma without completely stopping the use of Binary Loads?
Any insights or workarounds to secure this architecture would be greatly appreciated.
For context, what is the idea behind a developer using Binary and then modifying the data model? The section access should have persisted, so the capability of the STORE command exists at the base app or the secondary (binary) app.
Can you elaborate the team dynamic for more context?
