We ended up ditching Arango for a new project, despite it having decent enough graph handling.

This is because, unlike many other DBs (namely Mongo, which we're trying desperately to move away from), you can't spin up a new instance and allow the application to idempotently initialize it.

The multi-modal engine of Arango seems great, but the DX surrounding its use is a bit subpar, and would greatly shift a lot of burden to the environment config, which only adds to potential security vulnerabilities.

This is only made worse by the fact it has a severely limited granularity with security permissions.

Security is another big issue with the open graph databases. Some closed ones have ok mechanisms. But we are not there yet.

Out of curiosity, are you self managing the database today or using a service?

Self hosting. Services don't usually have as tight of security as I'd like.

I would argue that it's a common misconception: the risk of doing something wrong when you're self managing every layer means you're opening yourself up to so much surface area that needs to be done with expert precision.

Obviously services are not some magic wand either, EG the recent Microsoft snafus. But they're a third-tier cloud player