QueryProxy

QueryProxy is an open-source, self-hosted query approval portal that removes the need for a developer to hold the production password just to look at production data. The promise is simple: a developer writes SQL in a guarded editor, the portal parses the statement and refuses the dangerous ones before they are ever submitted, what remains goes to a DBA for approval, and once approved it runs on a queue outside the request cycle. Results come back masked. Credentials are never shown to the user at any point — the connection details sit encrypted inside the application and the portal itself is what runs the query. PostgreSQL, MySQL, MariaDB, SQL Server and SQLite are supported.

Four decisions carry the architecture. Guarding is done by parsing, not pattern matching: incoming SQL is analysed, an UPDATE or DELETE without a WHERE is refused, an unbounded SELECT comes back with a default row limit, and statements touching database or user management are blocked outright; comments and string literals are normalised so the gate cannot be slipped by wedging a comment in, and the executor holds an absolute row ceiling that applies whatever the SQL claims. Approval runs through a single service: the web UI, Slack and Microsoft Teams all land on the same decision point, a DBA approving their own request is closed on every channel (a system admin can override it, and the override is recorded), and two concurrent approvals are collapsed by a conditional update; chat callbacks are signed with HMAC-SHA256, closed to replay by a narrow time window, and the acting user is resolved from an admin-managed mapping rather than from anything the request declares about itself. Masking is applied on write: the result stream is read row by row and each row is masked before it reaches the file, so unmasked data never enters the result store; there are two rule types — column pattern and content regex — and three strategies — full, partial and hash — and a regular expression that cannot be evaluated at runtime leaves the value masked rather than exposed. The audit trail is immutable: the log table has no updated-at column, updates and deletes raise at the model level, and the log rows carry no foreign-key constraint at all, so removing a connection does not remove its history.

The product ships as a single container a team can bring up with docker run: the application, the queue worker and the scheduler run in one image, and the default configuration needs no external services. Team roles are DBA, Developer and Auditor, with a system admin above them that is not team-scoped. There is TOTP two-factor authentication, a host allowlist for outgoing webhooks, security headers and rate limiting on every surface. On the quality side there is a Pest test suite, a CI pipeline running across three PHP versions, dependency scanning through composer audit and npm audit, and a container vulnerability scan that fails the image before it is ever published. The licence is AGPL-3.0-only: anyone who modifies QueryProxy and serves it over a network has to publish those modifications under the same licence.