Your LLM Can Generate Perfect SQL - And Still Leak Your Database

We often build AI database apps like this:

User → LLM → SQL → Database

It works… until the LLM generates a valid query that:

• misses tenant isolation
• accesses a restricted field
• uses an invalid business rule
• returns more data than intended

So I tried a different approach:

User → LLM → Query AST → Validation → Policy → SQL

The LLM understands what the user wants.

Deterministic code decides what is actually allowed.

I’m building QueryForge around this idea — an open-source query engine for PostgreSQL, MySQL, MongoDB, Elasticsearch and OpenSearch.

-> Try QueryForge

-> GitHub

Would you trust an LLM to generate executable SQL in production?