Reverse Engineering of Vector tiles and Tiles Security

Question

I am using the following workflow to generate and visualize vector tiles.

1. Store edited shapefile to PostGIS
2. Create vector tiles using Tippecanoe from PostGIS data
3. Serve vector tiles through Tileserver-GL

Now when I am inspecting the resultant map site I found the pbf files in Network section. It contains some hexadecimal values. I am using proprietary dataset. This dataset is confidential. I want to know is this secured method? If there is any way of reverse engineering the PBF files of vector tiles what is that and how can I protect my tiles or data security?

Answer 1

No, the data is absolutely not secure by virtue of being encoded as vector tiles.

Vector tiles are typically PBF data (protocol buffers) in the Mapbox Vector Tile (MVT) specification. (Media type: application/vnd.mapbox-vector-tile.) It is a well-known binary format. The reason your map client knows how to display the data encoded in your vector tile is because it knows how to decode that information. It is trivial to read a vector tile back out to human-readable GeoJSON. Just check out this long list of vector tile parsers, generators, clients, servers, and CLI tools.

If your data is private and needs to be secure, then you want to secure your application, and also your server. There are lots of authentication and authorisation models, but typically a user would need to login in to your application, be authenticated, and then use proof of this authentication when making requests for your vector tiles. But the vector tiles themselves are just data, even if not human-readable in their native format. It seems you've already asked a good related question on this matter here.