Security & trust
You hand this site the address of a production database. Here is everything it does to deserve that, written for engineers rather than lawyers. Each point below describes what the code does today; the source is open, so you can check.
On this deployment
- onHTTPS enforced. Plain HTTP is redirected to HTTPS and browsers are told to use HTTPS for a year (HSTS).
- offEmail confirmation for new accounts. No mail server is configured, so accounts are usable at once.
- onReport sandbox. Reports are served with a Content-Security-Policy sandbox.
- offThird-party analytics. None. Page counts are kept on our own server without cookies.
Your database credentials
- The database password is never stored. It is handed to the analysis process through its environment for one run, then discarded. It is not written to our database, to the saved configuration, or to any log; saved configurations are stored with the password stripped.
- Read-only by construction. The analyzer runs SELECT, EXPLAIN and catalogue queries inside read-only transactions. EXPLAIN (ANALYZE), when used, runs in a transaction that is rolled back.
- Bounded load on your server. Every planning statement carries a statement_timeout and a lock_timeout, work is batched, and the number of parallel connections is capped, so an analysis cannot pile up on a busy primary.
- Encrypted connections to managed services. For Supabase, Neon, RDS, Cloud SQL, Azure and the other providers we know, sslmode=require is added automatically when the connection string does not already ask for TLS.
Your account
- Passwords hashed with scrypt. Each password is hashed with a per-account random salt using scrypt (N=2^14, r=8, p=1), a memory-hard function designed to make brute-forcing stolen hashes expensive. A minimum of ten characters is enforced and common passwords are refused.
- Rate-limited logins and sign-ups. Ten login attempts per address per ten minutes and five sign-ups per hour; forms also carry a honeypot field and a timing check that stop scripted submissions.
- Signed, expiring sessions. Sessions are HMAC-signed tokens with an expiry, stored in an HttpOnly, SameSite cookie, so scripts in the page cannot read them and other sites cannot send them.
- Every form is protected against cross-site requests. A double-submit CSRF token is checked on every POST, including log-out, theme changes and the cookie banner.
- You can delete everything yourself. The account page deletes your account, every analysis and every report file at once, no email to support required.
Isolation between users
- One folder per account, one per analysis. Report files live under a folder named after your account and the analysis id; file requests are checked against that folder, so a crafted path cannot reach another user's files.
- Reports are sandboxed. Your report is your own document, so it is served with a Content-Security-Policy sandbox: a script inside it cannot read cookies or act as you on this site.
- Customers cannot reach this server. Only the administrator may analyse a database on this host, switch OS user or hop through ssh. Customer requests must name a public network address; loopback, private and link-local targets are refused.
- Administrator access is explicit. The administrator can see every analysis to operate the service and help with support. This is stated in the privacy policy rather than hidden.
Browser protections
- Content-Security-Policy on every page. Scripts, styles, images and fonts may only come from this site (plus the analytics host if you accepted one); inline scripts are refused and the site cannot be framed by others.
- Hardening headers. X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy are sent on every response.
- No third-party scripts by default. The site loads no fonts, trackers or widgets from other domains. Optional analytics load only after you accept the cookie banner.
- Secrets stay on the server. Templates receive only what they display; signing keys, SMTP credentials and your database password never reach the browser.
Performance
- Compressed responses. HTML, JSON and report files above 1 KB are gzip-compressed; a large report downloads several times faster.
- Long-lived static assets. Stylesheet and script URLs carry a fingerprint of their contents, so browsers cache them for a week and still pick up every change the moment it is deployed.
- Analyses run in the background. Submitting the form queues the run; the page polls a small status endpoint and reloads when the report is ready, so the site stays responsive while psql does the work.
- Small, dependency-light stack. One process, a file database with write-ahead logging, and hand-written CSS of a few kilobytes. No client framework to download; every page works without JavaScript.
Reporting a problem
If you find a weakness, tell us before telling anyone else and we will fix it and credit you if you wish. Use the contact address published on this site.
Related: the privacy policy lists exactly what is stored and for how long; the terms describe what you agree to.