Security

What AI tools can and cannot do with your projects, and how to keep connections safe.

#What the server protects

• SQL runs only in your own project database, as its owner role, never as a superuser.
• The service_role key, the JWT secret and the database password are never returned by any tool.
• Read-only connections hide tools that change anything, and execute_sql accepts a single SELECT-style statement inside a READ ONLY transaction.
• Queries time out after 15 seconds and return at most 1,000 rows.
• Only hashes of tokens are stored; tokens can expire and can be revoked at any time.

#Prompt injection

Data in your tables can contain text written by your users. SQL results are marked as untrusted data so the model is told not to follow instructions inside them, but no model is perfectly safe. Keep these habits:

• Use read-only connections unless you need changes, and scope connections to one project with ?project_ref=.
• Approve each tool call that changes data; do not turn on automatic approval for read-write connections.
• Connect AI tools to development projects rather than production where you can.