Start Free Security Scan

Pinecone Security

Security considerations for RAG applications built on Pinecone — covering tenant isolation models, credential scope, namespace patterns, and how RAGSec tests Pinecone-backed systems.

Hero image: Pinecone Security — Pinecone | RAGSec

Pinecone’s isolation models

Pinecone's isolation models — Pinecone | RAGSec

Pinecone provides two mechanisms for separating data: separate indexes, and namespaces within a shared index. The security properties of each are different.

Index-per-tenant

Each tenant’s vectors are stored in a separate Pinecone index. Credentials scoped to a single index prevent cross-tenant access at the infrastructure layer. This is the strongest isolation model available in Pinecone but creates index management and cost overhead at scale.

Namespace-per-tenant

Multiple tenants share an index, separated by namespace. Namespaces are a logical partition — they do not enforce access control on their own. The application is responsible for setting the namespace on every query to the correct tenant value. If the namespace parameter is controlled by or influenced by user input, cross-namespace retrieval is possible.

Common Pinecone security misconfigurations

Common Pinecone security misconfigurations — Pinecone | RAGSec
  • Write-capable API key on the query path: Production retrieval code using a key that can also upsert, update, or delete vectors. This violates the principle of least privilege and increases the blast radius of a key compromise.
  • Namespace value from user input: The namespace parameter in a query is set from a value supplied or influenced by the end user, allowing an attacker to specify another tenant’s namespace.
  • Shared index with no namespace: All records stored in the default namespace with no tenant separation. Common in prototypes that become production.
  • API key in client-side code: Pinecone API keys embedded in browser JavaScript, mobile app bundles, or public configuration files.
  • Records without tenant metadata: Records lack a field identifying their owner, making audit, retention, and deletion unreliable.
  • Overly broad project scope: A single API key with access to multiple indexes, where only one is needed for the query path.

RAGSec coverage for Pinecone

  • Enumerate all indexes and namespaces within credential scope Available
  • Assess credential scope (read-only vs. write-capable vs. admin) Available
  • Tenant metadata coverage analysis Available
  • Sampled content classification Available
  • Active cross-namespace isolation test Available
  • Evidence package for confirmed cross-tenant failures Available
Free Pinecone scan
Pinecone connector details