Security
QueryGlow uses a defense in depth architecture with 9 security layers. Each layer covers a different risk, so one weak spot does not expose everything. The shared login is the front door: keep that password strong and private.
Internet → HTTPS/SSL → nginx → Basic Auth → QueryGlow on localhost (CSRF check, Safe Mode) → SSH Tunnel → Database9 Security Layers
1. HTTPS/SSL
Let's Encrypt TLS 1.2+
2. nginx Proxy
Security headers, rate limits (standalone mode)
3. Basic Auth
htpasswd, every request
4. Network Isolation
localhost:3000 only
5. Encryption at Rest
AES-256-GCM
6. CSRF Protection
Origin header validation
7. SQL Injection Prevention
Parameterized queries
8. SQLite Sandboxing
Path restricted to /app/data
9. CSV Sanitization
Formula injection protection
Core Security Features
Encryption at Rest
Database passwords, SSH keys and passphrases, and AI keys entered in the app are encrypted using AES-256-GCM with scrypt key derivation before being written to disk. Decrypted only in memory when needed.
GCM mode provides tamper detection: modified ciphertext fails to decrypt.
Network Isolation
The application binds to 127.0.0.1:3000 only. It is not reachable from the internet; only the nginx reverse proxy can reach it.
Even if the firewall is misconfigured, the app itself refuses external connections.
Safe Mode (Default: ON)
The Query Editor and agent tokens are blocked from DROP TABLE, TRUNCATE, and DELETE or UPDATE without WHERE. DROP DATABASE and statements that run commands or touch server files are blocked in every mode.
Configure via the QUERYGLOW_ALLOW_DESTRUCTIVE env var.
Rate Limiting
- • Standalone mode (nginx): a general limit of 60 requests per second per IP with 429 on excess, and Ask AI at 30 requests per minute.
- • Agent endpoint (in the app, both modes): 240 requests per minute per IP and 2,000 per minute overall.
- • Login: Basic Auth is not rate limited. Use a strong password and fail2ban watching nginx for repeated 401s.
New in 1.3.0
SSH host key pinning
The first connection through an SSH tunnel pins the server's host key fingerprint in data/ssh-known-hosts.json. A different key later is refused, with both fingerprints in the error. Before 1.3.0 any host key was accepted.
Verify server certificate
SSL connections can check the database certificate against the publicly trusted authorities. Off by default for new connections; connections saved earlier keep their engine's old behaviour; sslmode=verify-ca or verify-full in a pasted URL turns it on.
Confirmation before writes on production
On a connection marked production, the Query Editor shows the statement and asks before any INSERT, UPDATE, DELETE or DDL runs. On by default, can be turned off in Preferences.
AI keys entered in the app
OpenAI, Anthropic and Google keys can be entered in the app and are stored encrypted in data/ai-settings.json. A key in .env wins. Ask AI sends your database type, table and column names with their types, and your prompt. Never rows.
Agent activity and pause (1.2.1)
Agent tokens are read-only by default, enforced by the database. Every agent call, including refused and paused ones, shows up in the Activity tab. Pause one token or all of them with one click.
Updates with automatic rollback
./queryglow update backs up first, checks the new version and rolls back on failure. The app itself never checks for updates or phones home.
Access Model
Your team shares one Basic Auth login, asked once per browser. QueryGlow has no per-user accounts or roles. To limit what someone can do, use database users with the right grants (see Best Practices), and give agents their own tokens.