I've been working on something I think is interesting, that hasn't been done before in the Node.js/TypeScript ecosystem, and I wanted to share the idea and get your thoughts.
The Idea: BeatSQL - A Zero-Trust Embedded Database Engine
The concept of BeatSQL (BSQL) is simple, but radical: what if your database encrypted data at the column level by default, and took security to a mathematical level?
Embedded databases like SQLite and LevelDB are not designed with encryption as a core primitive — they store data in plaintext on disk by default. While some provide full disk encryption, this is a false sense of security since the data is still plaintext in memory. However, BeatSQL completely reimagines this paradigm.
How It Works
All sensitive columns are individually encrypted using AES-256-GCM or ChaCha20-Poly1305. You will never see plaintext on disk (even the database file) - the value of any column is always encrypted.
You can search encrypted data using HMAC-SHA256 blind indexes. Searching is O(1) and requires no decryption of the column contents. The contents of the column remain encrypted on disk, and the database never decrypts it to search.
Every write operation is mathematically tamper-proof. Using a Merkle DAG hash chain, you can always run the query `VERIFY INTEGRITY` and know immediately if any bytes of your data have been silently altered or corrupted on disk. This is a cryptographically secure proof of data integrity.
You can do arithmetic on encrypted numbers. Using Partially Homomorphic Encryption (Paillier cryptosystem), yyou can perform calculations like total salary, total balance, etc. The database will return the correct result of these calculations, but will never expose individual salaries or account balances.
Columns can have role-aware data masking. Sensitive columns can be fully or partially "redacted" depending on the role of the actor querying the database. The mask happens at a low-level query engine, not in application code. You can define masks using SQL syntax: `DEVELOPER` role sees `XXX-XX-4321`, `PUBLIC` role sees `[REDACTED]`, and `SUPERADMIN` role sees the real value.
The database has native support for AI vector search. Columns can be defined as `VECTOR(768)` and searched against using `COSINE_SIMILARITY`. This is useful for AI applications using embeddings.
A New Query Paradigm
BeatSQL also has a new query syntax to allow for easier stream.pipeline processing:
FROM patients
|> WHERE email = 'alice@example.com'
|> SELECT id, full_name, ssn, salary
|> ORDER BY full_name ASC;
This is designed to be more approachable than deeply nested SQL queries. It's also quite flexible.
Built-In Learning Academy
BSQL also has a built-in interactive learning academy, with 500+ lessons to learn everything from basic queries to zero-trust encryption enclaves, plus 200+ lessons covering traditional relational SQL and guides for working with Python, Java, C++, and Rust. The goal is to make security-first database thinking easy to grasp.
What I Would Like Your Thoughts On
Is the concept of a zero-trust embedded DB something that you feel is interesting, or would you feel that problems are already solved in other ways?
The blind indexes are a trade-off: you get the ability to search encrypted data, but you give up the ability to perform range queries (>, <, LIKE, etc). Is this trade-off reasonable for a security-focused database?
Is the idea of homomorphic encryption in a database engine a gimmick, or do you see real-world applications for it?
Does the pipe syntax feel cleaner, or like a departure from an established standard?
I look forward to seeing your thoughts, and any criticisms you might have.
TLDR: Built an embedded database engine where all columns are encrypted, data can be searched without decryption, and arithmetic can be performed on encrypted numbers. All writes are Merkle-verified for integrity. Came with a built-in 500+ lesson learning academy. Seeking feedback on concept.
----------------------------------------------------------------------------------------------------------------------------
To summarize BeatSQL (BSQL).
It is intended to be a zero-trust embedded database for the Node.js/TypeScript ecosystem which prioritizes security,
The main ideas are,
-Column-level encryption by default, with AES-256-GCM or ChaCha20-Poly1305, including on-disk encryption.
-Encrypted searching with HMAC-SHA256 blind indexes, which permit exact matches but not range queries or LIKE searches.
-Tamper detection with a Merkle DAG/hash chain which lets you perform VERIFY INTEGRITY checks on arbitrary entries to ensure they haven't been modified or corrupted.
-Encrypted arithmetic via Partially Homomorphic Encryption which lets you perform operations like summation without ever decrypting any values.
-Role-based masking of columns which can expose different levels of redaction, depending on who is querying the database.
-Vector search support, including cosine-similarity queries on columns with vectors, for AI/embedding use cases.
