The fastest offline SQL static analyzer. Built in Rust for zero false positives.

Catch SQL injection, performance regressions, missing indexes, unbounded queries, compliance violations, and 282+ more issues before they reach production. No database connection required.

git clone https://github.com/slowql/slowql.git
cd slowql
cargo install --path .

docker run --rm -v $(pwd):/src ghcr.io/slowql/slowql /src

# Scan a directory (default: proven mode, zero false positives)
slowql src/
# Scan a single SQL file
slowql queries.sql
# Scan with schema validation
slowql src/ --schema db/schema.sql
# Show all findings including hints
slowql src/ --min-confidence advisory
# CI mode with failure threshold
slowql src/ --fail-on high --format github-actions

# Proven mode (default) - safe for CI gates
slowql src/
# Contextual mode - for code review
slowql src/ --min-confidence contextual
# Advisory mode - for comprehensive audit
slowql src/ --min-confidence advisory

slowql src/ --schema db/schema.sql

# Preview fixes
slowql queries.sql --diff
# Apply fixes (creates .bak backup)
slowql queries.sql --fix
# Apply and write report
slowql queries.sql --fix --fix-report fixes.json

SELECT * FROM archive;  -- slowql-disable-line PERF-SCAN-001
-- slowql-disable-next-line SEC-INJ-001
SELECT id FROM sessions WHERE id = $1;
-- slowql-disable PERF-SCAN
SELECT * FROM logs;
-- slowql-enable PERF-SCAN
-- slowql-disable-file

# Create baseline of current issues
slowql src/ --update-baseline .slowql-baseline
# Only report new issues
slowql src/ --baseline .slowql-baseline

slowql . --git-diff
slowql . --since main

slowql src/ --export json --export html --export csv --out reports/

analysis:
  dialect: postgresql
  enabled_dimensions:
    - security
    - performance
    - reliability
    - cost
    - quality
  disabled_rules: []
  # min_confidence: proven
severity:
  fail_on: high
compliance:
  frameworks:
    - gdpr
schema:
  path: db/schema.sql

slowql --init

 rules:
 - id: ORG-001
   name: "Require tenant_id filter"
   severity: high
   dimension: security
   pattern: "SELECT.*FROM\\s+orders\\b(?!.*tenant_id)"
   message: "All queries on orders table must filter by tenant_id"

analysis:
  custom_rules: .slowql-rules.yaml

- name: SlowQL Analysis
  run: |
    slowql src/ --fail-on high --format github-actions

repos:
  - repo: https://github.com/slowql/slowql
    rev: v2.0.0
    hooks:
      - id: slowql
        args: [--fail-on, high]

Usage: slowql [OPTIONS] [FILES]...
Arguments:
  [FILES]...  Input SQL files or directories
Options:
  -d, --dialect <DIALECT>          SQL dialect
  -s, --schema <SCHEMA>            Path to DDL schema file
      --format <FORMAT>            Output format [console, json, sarif, github-actions]
      --export <EXPORT>            Export results to file (json, html, csv, sarif)
      --out <OUT>                  Output directory for exports [default: reports]
      --fail-on <FAIL_ON>          Fail at or above this severity
      --diff                       Preview safe autofix diff
      --fix                        Apply safe autofixes (.bak backup created)
      --baseline <BASELINE>        Path to baseline file
      --update-baseline <PATH>     Create or update baseline file
      --list-rules                 List all available rules
      --explain <RULE>             Show documentation for a specific rule
      --git-diff                   Only analyze files changed in git
      --since <REV>                Analyze files changed since a git revision
      --min-confidence <LEVEL>     Minimum confidence: proven, contextual, advisory
      --include-nonprod            Include test/example/seed contexts in output
      --compare                    Detect similar queries across files
      --init                       Create a slowql.yaml config file
      --verbose                    Enable verbose output
  -h, --help                       Print help
  -V, --version                    Print version

# List all rules
slowql --list-rules
# Filter by dimension
slowql --list-rules --filter-dimension security
# Filter by dialect
slowql --list-rules --filter-dialect postgresql
# Explain a specific rule
slowql --explain PERF-SCAN-001

Files -> Walker -> Context Classifier -> Parser -> Rule Engine -> Issues -> Reporter
                                           |           |             |
                                      Extractor    Schema        Autofix
                                    (app code)   Validator     (safe only)

git clone https://github.com/slowql/slowql.git
cd slowql
cargo build
cargo test