Introduction

QueryProxy is a self-hosted database access control and query approval portal. It sits between your team and your databases so that developers can work with production data without ever holding production credentials.

Instead of sharing passwords or opening ad-hoc tunnels, your team follows one flow:

1. Submit — a developer writes SQL in a guarded editor, against a connection a DBA granted them. Credentials stay in the encrypted vault.
2. Guard — the SQL is parsed and inspected before anything runs: UPDATE/DELETE without a WHERE is rejected, SELECT without a LIMIT gets one injected, administrative statements are blocked outright.
3. Approve — a DBA approves or rejects the request from the web queue or straight from Slack / Teams. Nobody can approve their own request.
4. Execute — a queue worker runs the query asynchronously, streams the result row-by-row, masks PII before it touches disk, and records every step in an immutable audit log.

What you get

• Teams & roles — Admin, DBA, Developer and Auditor roles; connections, requests and audit trails are isolated per team.
• Connection vault — PostgreSQL, MySQL, MariaDB, SQL Server and SQLite targets with AES-256-encrypted credentials.
• SQL guards — enforced by parsing, not pattern-matching.
• ChatOps approvals — interactive Slack buttons and a Teams action endpoint, both verified with HMAC-SHA256 signatures.
• Dynamic data masking — column-pattern and content-regex rules applied while results are written.
• Immutable audit log — who asked, who approved, what ran, what it touched.

Architecture at a glance

QueryProxy is a single Laravel application plus a queue worker and a scheduler — all three start from one docker compose up. By default it needs no external services: the application database is SQLite and the queue is database-backed. When you outgrow the defaults, MySQL/PostgreSQL and Redis are configuration changes, not migrations.

License

QueryProxy is open source under the AGPL-3.0 license. If you run a modified copy as a network service, you must publish your modifications under the same license.

Ready to try it? Continue with the Quick start.