Cloudflare D1's dual-mode adapter solves the security-vs-DX tradeoff: registry mode locks prod to an SQL allowlist (injection-proof even if keys leak), and SQL mode keeps dev fast and flexible. Auto-picks the right one per environment.