Local-first by design

Local-first data plane

BlastRadius Desktop connects to your database from your machine. Today that is a local PostgreSQL connection. Query execution, schema discovery, and workspace code analysis do not route database payloads through BlastRadius Cloud.

SQLite on your machine holds schema metadata and history metadata (SQL text, status, row counts) — not customer row grids as a warehouse.

Credential handling

Secrets never belong in source control, workspace settings, or our cloud database.

• Database passwords stored in OS keychain / VS Code SecretStorage
• Cloud API tokens stored in HTTP-only session cookies on this site
• No logging of passwords, connection strings, or API keys

SQL safety layer

AI-generated SQL is untrusted until validated. BlastRadius fails closed on parse errors and blocks writes, DDL, and multi-statement execution in the MVP read-only model.

• SELECT and read-only WITH … SELECT only
• Explicit user confirmation before execute
• Parameterized queries for catalog reads — no string concatenation from user input

Cloud control plane

BlastRadius Cloud stores account identity, subscription state, entitlements, and coarse usage counters. It does not store database row data or connection strings from your desktop sessions.

• JWT-based API authentication
• TLS for all cloud API traffic
• Privacy Policy and Terms describe retention and subprocessors

Security contact

If you believe you have found a security issue in BlastRadius, please report it responsibly. We acknowledge reports promptly and address confirmed issues as quickly as we can.

Report vulnerabilities: privacy@blastradius.in