carried out a security audit of Vitess. The primary focus of the audit was a new component of Vitess, VTAdmin. The goal was to conduct a holistic security audit which includes multiple disciplines to consider Users that can create keyspaces can deny access to already existing keyspaces” and “ADA-VIT-SA23-12, VTAdmin users that can create shards can deny access to other functions”. These two issues allowed a malicious the audit was VTA_{admin} which is located at https://github.com/vitessio/vitess/tree/main/go/vt/vtadmin. ## Threat model formalisation In this section we outline the threat model of Vitess's VTA_{admin}

Component – Build/CI – Cluster Management – Java – Observability – Query Serving – VReplication – VTAdmin – vttestserver ## • Type – Announcement – Bug – CI/Build – Documentation – Enhancement – Feature

Component – Build/CI – Cluster Management – Java – Observability – Query Serving – VReplication – VTAdmin – vttestserver ## • Type – Announcement – Bug – CI/Build – Documentation – Enhancement – Feature