The DuckDB CLI client supports “safe mode”. Safe mode can be enabled from the command line using the -safe argument:

duckdb -safe

Alternatively, it can be activated during a session using the .safe_mode dot command.

In safe mode, the CLI is prevented from accessing external files other than the database file that it was initially connected to and prevented from interacting with the host file system.

This has the following effects:

• The following dot commands are disabled:
  • .cd
  • .excel
  • .import
  • .log
  • .once
  • .open
  • .output
  • .read
  • .sh
  • .system
• Auto-complete no longer scans the file system for files to suggest as auto-complete targets.
• The getenv function is disabled.
• The enable_external_access option is set to false. This implies that:
  • ATTACH cannot attach to a database in a file.
  • COPY cannot read to or write from files.
  • Functions such as read_csv, read_parquet, read_json, etc. cannot read from an external source.

Once safe mode is activated, it cannot be deactivated in the same DuckDB CLI session.

For more information on running DuckDB in secure environments, see the “Securing DuckDB” page.