Query runner

The Query Runner tab lets you run custom SQL queries against your database. This is an owner-only feature — members and viewers cannot execute arbitrary SQL.

Safety

Three defenses run before execution:

1. Whitelist — only SELECT, WITH, VALUES, and TABLE statements are allowed (checked on comment-and-literal-stripped text)
2. Multi-statement rejection — no ; separator outside strings and comments
3. BEGIN READ ONLY + ROLLBACK — blocks INSERT/UPDATE/DELETE/DDL at the transaction level

These are the same defenses used by the Explain tab.

Access

Only instance owners can run queries through this tab. Invited members (viewers and admins) get the curated monitoring dashboards through the other API endpoints. Ad-hoc SQL execution carries risk — volatile functions, pg_read_file, dblink, and query-time resource consumption are the owner's responsibility.

Limitations

• Multi-statement queries are rejected
• Results are returned as JSON and displayed in a table
• Large result sets may be truncated by the browser