Security

To report a vulnerability, email the maintainers privately, and don't open a public issue.

This page sums up a review from 2026-10-31, covering how ant builds SQL, what it logs, and how it handles secrets. It was done by the project's own tooling and authors, not an outside auditor.

SQL injection

Path	Protection
Values in queries	Always bound as parameters, in every statement ant writes
Column and table names	Come from struct metadata, never from input, and are quoted
OrderByfunc (t *Table[T]) OrderBy[V Ordered](field *V) *Query[T]OrderBy starts a query ordered by field, ascending., Wherefunc (t *Table[T]) Where(c ...Cond) *Query[T]Where starts a query with conditions., joins	Take field probes, so a request can't name a column
Query comments and hints	Comment delimiters are removed, so they can't close the comment
JSON paths	Bound as a parameter, and each part is quoted
Migration scripts	Identifiers are quoted, and text is escaped

These take raw SQL by design, and must never be built from input. Pass values as arguments.

• ant.Rawfunc Raw[T any](h Handle, query string, args ...any) *RawQuery[T]Raw prepares a raw SQL statement., ant.RawFilefunc RawFile[T any](h Handle, fsys fs.FS, name string, args ...any) *RawQuery[T]RawFile is Raw with the statement read from a file in fsys, such as an embed.FS., ant.FromRawfunc FromRaw[T any](h Handle, text string, args ...any) *Query[T]FromRaw returns a query over raw SQL, which conditions, ordering, and paging then build on., ant.FromFuncfunc FromFunc[T any](h Handle, call string, args ...any) *Query[T]FromFunc reads from a table-valued function, written with ? for its arguments, as in generate_series(?, ?).
• ant.SQLfunc SQL[V any](text string, args ...any) Expr[V]SQL returns an expression from raw SQL., ant.SQLCondfunc SQLCond(text string, args ...any) CondSQLCond returns a condition from raw SQL.
• b.Checkfunc (b *ModelBuilder[E]) Check(name, expr string)Check adds a check constraint., .Default, .Generated, .Type, .Where on indexes, which are written by developers, into migrations
• q.Hintfunc (q *Query[T]) Hint(hint string) *Query[T]Hint adds an optimizer hint, written /*+ hint */ before the statement, in the form extensions such as pg_hint_plan read., q.Tagfunc (q *Query[T]) Tag(name string) *Query[T]Tag adds a comment to the SQL, so a query can be found in database logs., and ant.Funcfunc Func[R any](name string, args ...any) Expr[R]Func calls a database function by name.'s name

A helper that takes a column or sort order from a request should map it through a fixed list.

Logs and errors

• Values stay out of logs unless ant.LogValuesfunc LogValues() LogOptionLogValues includes argument values in logs. is set.
• .Sensitive() keeps a column out even then. ant.SQL arguments aren't covered, since ant can't tell which column they belong to.
• Query errors hold the SQL with its placeholders, for ant.FailedSQLfunc FailedSQL(err error) stringFailedSQL returns the statement behind a query error, or "".. WithDetailedErrors adds it to the message, so leave that off where errors reach users.
• A database error's message can quote a value, and WithLogger logs that message. Don't return err.Error() to users.
• Query.Debugfunc (q *Query[T]) Debug() *Query[T]Debug logs this query's SQL and values when it runs, at info level, through slog's default logger. shows values on purpose, and is meant for a desk, not production.

Secrets

• secure.Valuetype Value[] struct{ … }Value holds a Go value that is encrypted in the database. uses AES-256-GCM with a random nonce, and prints and marshals as [encrypted].
• A ciphertext isn't bound to its row. See encrypted fields.
• ant doesn't log connection strings. An error from Open comes from the driver, and a badly malformed connection string can still reach the message, so treat that error as sensitive.

Tenancy

A global filter is a convenience, not a security boundary, because ant.Raw and IgnoreFiltersfunc (t *Table[T]) IgnoreFilters( names ...string, ) *Query[T]IgnoreFilters starts a query with the named global filters off. bypass it. See multi-tenancy.

Migrations

• reset needs the database's name, typed or passed with --confirm, and refuses otherwise.
• A checksum stops an applied file changing unnoticed. It detects mistakes, not attackers.
• Migration files are code. Treat access to them, and to the embedded binary, like access to the database.