Drizzle ORM Safe & Unsafe Practices
Drizzle parameterizes values in its query builder and sql template tag, which prevents SQL injection. The risks come from sql.raw with user input and from pushing schema changes straight to production. Generate migration files, review them, and apply them deliberately.
Credentials & Where They Belong
Read from environment variables, never committed.
Safe Practices
Use the query builder or sql template tag
Interpolated values become bound parameters automatically.
Generate migrations and review them
drizzle-kit generate produces SQL files you can inspect before applying.
Keep migrations forward-only and immutable
Fix mistakes with new migrations instead of editing applied ones.
Unsafe Practices
Passing user input to sql.raw
sql.raw skips parameterization and enables SQL injection.
Running drizzle-kit push against production
Push applies schema diffs without a reviewable migration history.
Editing migrations that already ran
Environments drift apart and future migrations fail.
RealComposer defines its schema in Drizzle, generates migrations with drizzle-kit, and applies them manually after review so production changes are always deliberate.
Frequently Asked Questions
Q:Is Drizzle safe from SQL injection?
Yes when you use the query builder or sql template tag. sql.raw with untrusted input is the exception.
Related Concepts
Type-safe API contracts use shared type definitions or schemas so the compiler can verify that clients and servers agree on request and response shapes. Mismatches, such as a renamed field, surface as build errors instead of runtime crashes in production.
Principle of Least PrivilegeThe principle of least privilege states that every user, service, and credential should have only the minimum permissions required to perform its task. For APIs, this means using restricted keys, narrow OAuth scopes, and client tokens limited to specific endpoints.
API Audit LoggingAPI audit logging is recording a tamper-resistant history of security-relevant events, such as who called which endpoint, when secrets were created or rotated, and which tokens were revoked. Audit logs support incident investigation, compliance, and accountability.