From b4c01c396d80679c430297e496944aa6ffef7681 Mon Sep 17 00:00:00 2001
From: Bart Louwers <bart@emeel.net>
Date: Sat, 3 Jan 2026 22:14:11 +0100
Subject: [PATCH 1/2] sqlite: enable defensive mode by default

---
 src/node_sqlite.h                   |  2 +-
 test/parallel/test-sqlite-config.js | 13 ++++++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 2641c9d4f1e8c5..fc4918290e15d9 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -79,7 +79,7 @@ class DatabaseOpenConfiguration {
   bool return_arrays_ = false;
   bool allow_bare_named_params_ = true;
   bool allow_unknown_named_params_ = false;
-  bool defensive_ = false;
+  bool defensive_ = true;
 };
 
 class DatabaseSync;
diff --git a/test/parallel/test-sqlite-config.js b/test/parallel/test-sqlite-config.js
index eb8455ff45c8df..411b9d1cfaeace 100644
--- a/test/parallel/test-sqlite-config.js
+++ b/test/parallel/test-sqlite-config.js
@@ -20,9 +20,9 @@ function checkDefensiveMode(db) {
   }
 }
 
-test('by default, defensive mode is off', (t) => {
+test('by default, defensive mode is on', (t) => {
   const db = new DatabaseSync(':memory:');
-  t.assert.strictEqual(checkDefensiveMode(db), false);
+  t.assert.strictEqual(checkDefensiveMode(db), true);
 });
 
 test('when passing { defensive: true } as config, defensive mode is on', (t) => {
@@ -32,13 +32,20 @@ test('when passing { defensive: true } as config, defensive mode is on', (t) =>
   t.assert.strictEqual(checkDefensiveMode(db), true);
 });
 
+test('when passing { defensive: false } as config, defensive mode is off', (t) => {
+  const db = new DatabaseSync(':memory:', {
+    defensive: false
+  });
+  t.assert.strictEqual(checkDefensiveMode(db), false);
+});
+
 test('defensive mode on after calling db.enableDefensive(true)', (t) => {
   const db = new DatabaseSync(':memory:');
   db.enableDefensive(true);
   t.assert.strictEqual(checkDefensiveMode(db), true);
 });
 
-test('defensive mode should be off after calling db.enableDefensive(false)', (t) => {
+test('defensive mode off after calling db.enableDefensive(false)', (t) => {
   const db = new DatabaseSync(':memory:', {
     defensive: true
   });

From 5eec394952b71148966b44e22430f028e4eaab4e Mon Sep 17 00:00:00 2001
From: Bart Louwers <bart@emeel.net>
Date: Sat, 3 Jan 2026 22:23:53 +0100
Subject: [PATCH 2/2] doc: update documentation on defensive flag

---
 doc/api/sqlite.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 186e70784b94d0..c37e51f28bc235 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -104,6 +104,9 @@ exposed by this class execute synchronously.
 <!-- YAML
 added: v22.5.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/61266
+    description: Enable `defensive` by default.
   - version:
       - v25.1.0
       - v24.12.0
@@ -154,7 +157,7 @@ changes:
   * `defensive` {boolean} If `true`, enables the defensive flag. When the defensive flag is enabled,
     language features that allow ordinary SQL to deliberately corrupt the database file are disabled.
     The defensive flag can also be set using `enableDefensive()`.
-    **Default:** `false`.
+    **Default:** `true`.
 
 Constructs a new `DatabaseSync` instance.