CryoSPARC is only designed to be deployed within a trusted internal network, and no part of CryoSPARC (including the MongoDB database) should ever be exposed to any untrusted network or the public internet.
This is all good and well, but even the most hardened network is still subject to infiltration despite the best efforts of a security team. If a bad actor were able to install a backdoor to a trusted network, then they could proceed to exploit any additional unpatched vulnerabilities (such as MongoBleed). Ideally risk would be mitigated by ensuring that components within a perimeter (trusted network) would be as secure as possible as well.
As you’ve pointed out, in this case the point is moot since CryoSPARC does not use zlib compression. At the same time, MongoDB is an incredibly complex piece of software with a very large attack surface compared to simpler databases and it’s more intended to be used in distributed environments. As has been discussed in other posts, Structura does not intend to support running a MongoDB instance separately from the CryoSPARC master ( Use of a standalone MongoDB server? - #3 by wtempel ), which somewhat weakens the case for using it, since it can’t be run in a cluster to provide redundancy, etc.
Are there any plans to perhaps switch to using an embedded database (e.g., SQLite, LevelDB, BadgerDB, or DuckDB) on the master possibly with an API endpoint in front of it to translate RPCs from workers into CRUD operations? Such a setup would likely be generally more secure and easier to maintain.