The problem with allowlists
SQL allowlists were designed for a world where queries were written by people and rarely changed. That world no longer exists.
- Manual maintenance: every new query has to be added to the list by hand. Forget one and it is blocked in production.
- Brittle: minor changes such as whitespace, column aliases or reordered parameters break the match entirely.
- Binary: no severity levels, no flagging, no monitoring mode. It is allow or deny, nothing in between.
- No context: they cannot tell
DELETE FROM users WHERE id = 5fromDELETE FROM users. Both are just text. - Easy to bypass: text matching is easily sidestepped with comments, encoding tricks or restructuring the query.
How Vericto is different
Vericto does not match text. It understands structure.
- Full AST analysis: it understands the structure of the query, not just the text. Whitespace, comments and formatting are irrelevant.
- Automatic: works with any query without prior registration. No list to maintain, no queries to approve.
- Granular: 5 severity levels (critical, high, medium, low, informational) combined with 3 enforcement actions (block, flag, monitor).
- Deterministic: the same input always produces the same result. No statistical variance, no model drift.
- Zero maintenance: rules apply structurally, not per query. A single rule covers infinite query variations.
Side-by-side comparison
| Feature | SQL allowlists | Vericto |
|---|---|---|
| Handling new queries | Must be added manually | Evaluated automatically |
| Detection method | Text/regex matching | Full AST analysis |
| False positives | High (whitespace, aliases) | Zero (structural analysis) |
| Severity levels | None (allow/deny only) | 5 levels (critical to informational) |
| Enforcement actions | Block only | Block / Flag / Monitor |
| Maintenance effort | High (per query) | Zero (rules are structural) |
| Latency overhead | Variable (regex complexity) | P99 < 2ms (compiled native) |
| SQL injection detection | Limited | Full tautology detection |
| Suggested safe query | No | Yes (generated automatically) |
| Audit trail | Usually none | Complete, immutable log |
| CI/CD integration | Manual scripts | Native HTTP API |
Migrating from allowlists
Move from allowlists to Vericto without disrupting your production traffic.
No code changes required. Vericto runs as a transparent proxy: your application connects to Vericto instead of connecting directly to the database. Zero application-level modifications.
- Deploy the proxy: point your connection string at the Vericto proxy. Takes under 5 minutes.
- Turn on observe mode: Vericto evaluates every query but blocks nothing. You see what would be flagged.
- Validate: review the audit trail, tune the severity thresholds and confirm no legitimate query would be blocked.
- Enforce: switch to enforcement mode. Destructive queries are now blocked in real time.
Gradual rollout is fully supported. You can enforce protection on specific tables, specific severity levels or specific query types while keeping the rest in observe mode.
Stop maintaining allowlists by hand
Let structural analysis handle query security. Deploy in under 5 minutes.