QueryProxy
Production data access, without production credentials.
- Published by
- Tignex
- Home
- queryproxy.com
- Status
- Self-hosted · Docker or PHP 8.3+
- License
- AGPL-3.0
The problem
Developers need production data, and the ways they get it are all bad: a shared password, a personal account with more rights than anyone remembers granting, or a tunnel opened for one incident and never closed. The credential outlives the reason it was issued, and nobody can say afterwards which query actually ran.
The approach
QueryProxy puts a workflow where the credential used to be. A developer writes SQL in a guarded editor; an AST parser inspects the statement before anyone looks at it; a DBA approves or rejects it from the web interface or straight from Slack or Teams; the approved query then runs asynchronously and the result comes back masked and recorded.
It runs on your own infrastructure — Docker or a PHP 8.3+ server — in front of PostgreSQL, MySQL, MariaDB, SQL Server or SQLite. The database keeps its credentials; the people keep their work.
What it is not
It is not a bastion host and not a VPN replacement. Those control who can reach the database; QueryProxy reads the query itself, which is the part that decides whether the access was safe.
Frequently asked
- Is QueryProxy a replacement for a bastion host or a VPN?
- No. Those control who can reach the database. QueryProxy reads the query itself, which is the part that decides whether the access was safe. Keep the network controls and put approval where the statement is.
- Which databases does it sit in front of?
- PostgreSQL, MySQL, MariaDB, SQL Server and SQLite.
- How do approvals actually happen?
- A developer writes SQL in a guarded editor and an AST parser inspects the statement first. A DBA then approves or rejects it from the web interface or straight from Slack or Teams; the approved query runs asynchronously and the result comes back masked and recorded.
- Is there a hosted version?
- No, deliberately. A system that sees every production query is not one to hand to a third party, so it runs on your own infrastructure — Docker or a PHP 8.3+ server.
Part of Tignex
QueryProxy is developed and published by Tignex, an independent open-source engineering organization. The project keeps its own name, identity and home; Tignex is the engineering behind it.