{
  "port": 5432,
  "protocol": "tcp",
  "service": "PostgreSQL",
  "oneLiner": "PostgreSQL client protocol, TCP 5432.",
  "whatItIs": "The postgres server listens on TCP 5432 by default (the `port` parameter), and listen_addresses defaults to localhost, so an out-of-the-box install accepts only loopback TCP plus Unix-domain sockets. Seeing it on a scan means someone set listen_addresses to '*' or a real interface — common for containerized deploys, managed database endpoints, and pgbouncer front-ends. Who may connect from where is then decided by pg_hba.conf, which is a separate gate from the listener.",
  "exposure": {
    "verdict": "never",
    "note": "Keep it on localhost or a private network; if it must cross a network, require hostssl plus scram-sha-256 in pg_hba.conf rather than relying on the port being obscure."
  },
  "checkCommand": "psql -h DB_HOST -p 5432 -U postgres -c 'SELECT version();'",
  "links": [
    {
      "title": "PostgreSQL docs — Connection Settings (port, listen_addresses)",
      "url": "https://www.postgresql.org/docs/current/runtime-config-connection.html",
      "kind": "official-docs"
    },
    {
      "title": "PostgreSQL docs — The pg_hba.conf File",
      "url": "https://www.postgresql.org/docs/current/auth-pg-hba-conf.html",
      "kind": "official-docs"
    },
    {
      "title": "PostgreSQL (GitHub mirror)",
      "url": "https://github.com/postgres/postgres",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}