Bytebase

What Bytebase does

Most DevSecOps tooling focuses on application code. Database changes — schema migrations, permission grants, data access — usually happen through a separate, less controlled process: someone connects to production and runs a SQL script, or changes go through a ticketing system disconnected from the deployment pipeline.

Bytebase brings database changes into the same review-and-approval workflow as code changes. Engineers open a "database change request" instead of a PR, it goes through SQL lint checks (100+ built-in rules), gets reviewed by a DBA or senior engineer, and merges via GitOps when approved.

Security controls

Beyond change management, Bytebase handles the security controls that databases specifically need:

• Dynamic data masking: Sensitive columns (PII, financial data) are masked in query results for users who don't have access, without changing the underlying data
• Just-in-time access: Grant temporary database access that expires automatically, with a full audit log of what was accessed
• SQL review policies: Block destructive operations (DROP TABLE without WHERE, DELETE without WHERE) from reaching production

Why it's in the CNCF

Bytebase is the only database DevOps project in the CNCF Landscape as of 2026 — which reflects how underserved this problem is. Most cloud-native tooling treats databases as a black box. Bytebase treats them as a first-class part of the deployment pipeline.

Pricing

Community edition is free for self-hosted deployments with up to 20 users. Pro plan at $20/user/month adds SSO, advanced masking policies, and priority support. Enterprise pricing for larger deployments.