Operations Manual
Overview of Security Levels for Extensions
DuckDB offers the following security levels for extensions.  
| Usable extensions | Description | Configuration |
|-----|---|---|
| core | Extensions can only be installed from the `core` repository. | `SET allow_community_extensions = false` |
| core and community | Extensions can only be installed from the `core` and `community` repositories. | This is the default security level. |
| any extension incl. unsigned | Any extensions can be installed. | `SET allow_unsigned_extensions = true` |  
Security-related configuration settings [lock themselves](#docs:operations_manual:securing_duckdb:overview::locking-configurations), i.e., it is only possible to restrict capabilities in the current process.  
For example, attempting the following configuration changes will result in an error:  
```sql
SET allow_community_extensions = false;
SET allow_community_extensions = true;
```  
```console
Invalid Input Error: Cannot upgrade allow_community_extensions setting while database is running
```