Framework Coverage
One matcher model.
Multiple framework families.
queryaware normalizes all supported route styles into one route-entry model, then traces call graphs across layers.
You ship fast with AI. Your database quietly pays for it. queryaware scans your codebase and finds the expensive query mistakes — before your users do.
It'll generate this pattern without blinking — and your app will crawl under real traffic.
const files = await prisma.file .findMany(); for (const file of files) { // 1 DB call per file 😬 const owner = await prisma.user.findUnique({ where: { id: file.ownerId } }); } // 20 files → 21 queries // 1000 files → 1001 queries
const files = await prisma.file .findMany(); const ids = files.map(f => f.ownerId); // 1 call for all owners ✓ const owners = await prisma.user.findMany({ where: { id: { in: ids } } }); // always 2 queries. always.
Now includes cross-file signal quality via call-graph tracing and raw-query safety checks.
Detects Prisma calls inside loops. One query becomes N queries. Scales linearly with your data. Silent until it isn't.
High SeverityFlags findMany with no where clause. Full table scans and potential data leaks in multi-tenant setups. A security and performance risk in one.
High SeverityCatches create, upsert, and update calls inside loops. N writes where one transaction would do. Kills throughput under load.
Medium SeverityFlags $queryRawUnsafe and $executeRawUnsafe usage where input handling can introduce injection risk.
Detects risky Prisma.raw() fragment composition patterns that can bypass safe parameterization boundaries.
Catches wildcard column fetches in raw SQL that over-read data and increase payload, CPU, and query cost.
Medium SeverityFlags unbounded DELETE statements in raw SQL before they can wipe entire tables by mistake.
High SeverityFlags unbounded UPDATE statements in raw SQL that can mass-modify rows and create production incidents.
High Severityqueryaware normalizes all supported route styles into one route-entry model, then traces call graphs across layers.
Pure static analysis. Prisma support is live today. Additional ORM adapters are in active development.
"I found 17 of these patterns in my own production codebase. I built queryaware so you don't have to find them the hard way."
Call-graph support is now shipped. Next focus: broader framework adapters, richer SQL analysis, and stronger risk scoring.
Nuxt/Nitro, Remix loaders/actions, and tRPC procedures so route discovery covers more real-world Node and TypeScript stacks.
Catches anti-patterns inside Prisma.sql tagged templates — missing WHERE, SELECT *, and unsafe interpolation in raw queries.
Flags $queryRawUnsafe with string interpolation. Detects injection risks before they reach your production database.
Drizzle, TypeORM, Sequelize. Same detection engine, pluggable adapters. Built ORM-agnostic from day one.
Run queryaware and find out. 10 seconds to scan.
The fix might save you hours of debugging at 2am.
Planned matcher coverage and entrypoint models currently in backlog.