Documentation

Environments

Every connection is tagged Development, Staging or Production. The tag changes what QueryGlow shows you and what it asks before it runs something. Safe Mode, a separate server setting, decides what is blocked on every connection.

Confirm writes on production (since 1.3.0)

On a connection marked Production, the Query Editor stops before it runs an INSERT, UPDATE, DELETE or DDL statement, a data modifying CTE or SELECT INTO. The dialog Run on production? says "This statement writes to <connection>, a production connection.", shows the full statement, and offers Cancel and Run on production. It also appears when you start the query with the Run shortcut.

  • On by default. Turn it off with Confirm writes on production in Preferences (stored per browser).
  • Query Editor only. The Data Browser has its own typed DELETE confirmation.
  • It is a confirmation, not a permission: it blocks nothing beyond what Safe Mode already blocks.
QueryGlow Run on production? dialog showing an UPDATE statement with Cancel and Run on production buttons

What Changes on a Production Connection

  1. A red badge everywhere. The sidebar row, the header breadcrumb (environment, connection, database and table) and the Agent Access dialog carry the badge. The browser tab title carries the connection name.
  2. The Query Editor asks before any write, as described above.
  3. Typed confirmations. Deleting rows in the Data Browser shows a Production Warning, and you type DELETE to enable Delete from Production. The Structure dialog shows a PRODUCTION label, and a destructive column change runs only with Execute on Production.
  4. Agents reach production only when you allow it. An agent token can use a production connection only if you tick it, and the dialog warns "This token includes a production connection."

The Three Environments

Developmentdev

Local databases, test containers and experiments. Green badge.

Stagingstg

Pre-production environments. Amber badge, a reminder that this data may matter.

Production prod

Live customer data. Red badge in the sidebar and the header, a confirmation before every write in the Query Editor, and a typed DELETE with a red Production Warning when you delete rows.

What an Environment Does Not Do

  • It does not block queries. It makes you confirm; Safe Mode is what blocks.
  • It does not change what the database user may do. Use a read-only database login for that.
  • Safe Mode applies the same rules to every environment.

Safe Mode: What Is Blocked

Safe Mode covers the Query Editor and every agent call. The Data Browser's edit and delete buttons and the Structure dialog use their own previews and confirmations instead.

Blocked by default (Safe Mode):

  • DROP TABLE and TRUNCATE
  • Dropping indexes, views, materialized views, sequences and schemas
  • DELETE or UPDATE without a WHERE clause

Power Mode (QUERYGLOW_ALLOW_DESTRUCTIVE=true) lifts this tier.

Always blocked, in both modes:

DROP DATABASE, SHUTDOWN, and SQL that runs commands on the server or moves data through files on it (INTO OUTFILE, LOAD DATA, COPY ... PROGRAM and similar).

Default: on

QUERYGLOW_ALLOW_DESTRUCTIVE=false

Scope: global

Applies to all connections, whatever their environment

To change it, edit .env in your QueryGlow directory and recreate the container (a plain restart does not read .env again):

docker compose -f docker-compose.production.yml up -d --force-recreate queryglow

Learn more: Query Editor | Environment Variables

Best Practice

Use both together: mark live databases as Production so QueryGlow asks before writes and before deletes, and keep Safe Mode on so whole-table deletes and drops are blocked even if you confirm by mistake.

How to Set an Environment

  1. Open the New Connection or Edit Connection dialog.
  2. Under Basic Information, find Environment.
  3. Select Development, Staging, or Production.
  4. Click Create or Update.

The environment is stored with the connection and can be changed anytime by editing the connection.