SQLPad admin and service tokens concentrate database reach
A SQL console can be more sensitive than the databases it reaches. SQLPad stores connection definitions and lets users run queries, while administrators can manage users and connections [1]. A service token created by an administrator can turn a browser convenience into a durable API credential with broad database reach.
The documented roles
SQLPad supports local authentication with email and password by default. Passwords are stored in its embedded database using bcrypt hashing. The initial administrator is configured through SQLPAD_ADMIN, optionally with SQLPAD_ADMIN_PASSWORD, and additional users are added by an administrator [1].
The application has two roles today, Admin and Editor. An administrator can add or edit database connections and create users. The configuration documentation says service tokens are generated by logging in as an admin and using the Service Tokens page [2]. Those tokens deserve separate review because they may outlive a browser session and are intended for automation.
Query evidence
I ran three count-only probes on 2026-11-09 with sub_type=all, page 1, and page size 1. The application-fingerprint query app="SQLPad" matched 1,067. The title query title="SQLPad" matched 1,022. A body query http.body="SQLPad" matched 1,084.
The three counts are close, which is useful but not proof that every match is a working SQLPad instance. The app fingerprint is the strongest discovery signal in this run. The count still does not show whether authentication is enabled, which databases are connected, or who holds a service token.
Review the connection authority
Inventory every connection, its database role, network path, and owner. A SQLPad administrator may be able to edit a connection string even if they do not know the database password. The connection can use a privileged database account, so SQLPad's own role check is not the only authorization layer.
Prefer a dedicated read-only database account for analytic work. Use a separate connection for a job that needs writes. Do not let an Editor share a connection whose credentials can modify every tenant. Query-level controls, database roles, and row-level policies should remain in force.
Review the SQLPAD_USERPASS_AUTH_DISABLED and default-role settings. The documentation warns that disabling local user-password authentication can require a default role for users from another identity source [1]. A misconfigured default of Admin turns authentication success into administrative authority.
Protect API and service tokens
The API overview documents HTML Basic authentication for users and password access unless local authentication is disabled. Service tokens are a separate mechanism. Keep tokens in a secret manager, scope each one to a dedicated operator, and record the purpose and owner.
Test the API with a token that should be denied. Confirm that the denial is enforced by SQLPad and by the database account, not only by the UI. Review token creation and last-use records. Revoke stale tokens after integration or staff changes.
Restrict the web and API paths to a management network or a reverse proxy with strong authentication. Require TLS. Protect the embedded database because it contains password hashes, connections, and session state. Back it up with encryption and restrict restore access.
Monitoring and incident response
Log user, connection, query identifier, row count, and result status without storing the query text or returned data in an exposed log. Alert on queries that read unusually large volumes, connection changes, new administrators, and service-token creation.
If an administrator account is compromised, disable it, revoke its sessions and service tokens, and review connection changes. Determine which database credentials were visible and rotate them. Review the databases' own audit logs because SQLPad may not record every statement or data access.
The external SQLPad count is a discovery metric. It does not say whether a console is internet-facing, which databases are connected, or whether a token has broad authority. Review those facts at the owner, then use the count to organize outreach and follow-up.
Top comments (0)