
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
High-performance database CLI and Python library with Django ORM analysis, SSH tunneling, and multi-database support (PostgreSQL, MySQL, SQLite)
The modern database CLI and Python library that speaks your language — PostgreSQL, MySQL, SQLite with zero compromises. Built for developers, data analysts, and Django teams.
DBCrust combines a high-performance database CLI with a powerful Python library for database management and Django ORM optimization. Built in Rust for maximum performance, it provides an intuitive interface for PostgreSQL, MySQL, and SQLite with advanced features that boost developer productivity and catch performance issues early.
# Quick run with uv (no installation needed)
uvx dbcrust postgres://user:pass@localhost/mydb
# Or install globally
uv tool install dbcrust
dbcrust postgres://user:pass@localhost/mydb
# Short alias also available
dbc postgres://user:pass@localhost/mydb
# Multi-database support
dbcrust mysql://user:pass@localhost/mydb
dbcrust sqlite:///path/to/database.db
# Docker container databases
dbcrust docker://postgres-container
dbcrust docker:// # Interactive container selection
DBCrust isn't just a CLI – it's a powerful Python library designed for developers working with databases and Django applications.
import dbcrust
# Execute SQL queries programmatically
result = dbcrust.run_command("postgres://user:pass@localhost/db", "SELECT * FROM users LIMIT 10")
# Django ORM performance analysis
from dbcrust.django import analyzer
with analyzer.analyze() as analysis:
books = Book.objects.all()
for book in books:
print(book.author.name) # Detects N+1 queries automatically
# Get results
results = analysis.get_results()
print(results.summary)
📖 Complete Python & Django Documentation →
# Install globally as a tool
uv tool install dbcrust
# Or run directly without installation
uvx dbcrust postgres://user:pass@localhost/mydb
# Using uv
uv pip install dbcrust
# Using pip (if you prefer)
pip install dbcrust
git clone https://github.com/clement-tourriere/dbcrust.git
cd dbcrust
cargo install --path .
# PostgreSQL
dbcrust postgres://postgres:pass@localhost/myapp
# MySQL
dbcrust mysql://root:pass@localhost:3306/myapp
# SQLite
dbcrust sqlite:///./myapp.db
# Docker containers
dbcrust docker://my-postgres-container
dbcrust docker://user:pass@container-name/database
-- List databases
\l
-- List tables
\
dt
-- Describe table structure
\d users
-- Switch database
\c analytics
-- List Docker containers
\docker
-- Query with autocompletion
SELECT id, name, email
FROM users
WHERE active = true;
Enable EXPLAIN mode to see execution plans:
\e
SELECT * FROM users WHERE email = 'user@example.com';
Output:
○ Execution Time: 1.23 ms
○ Planning Time: 0.15 ms
Index Scan
│ Finds relevant records based on an Index. Index Scans perform 2 read operations: one to read the index and another to read the actual value from the table.
│ ○ Duration: 0.96 ms
│ ○ Cost: 4
│ ○ Rows: 1
│ on users
│ using email_idx
│ filter (email = 'user@example.com')
├► id + name + email + created_at
# Connect through SSH tunnel
dbcrust postgres://user:pass@db.internal.com/myapp \
--ssh-tunnel jumphost.example.com
# With SSH credentials
dbcrust postgres://user:pass@db.internal.com/myapp \
--ssh-tunnel user:pass@jumphost.example.com:2222
# Connect using HashiCorp Vault
dbcrust vault://app-role@database/postgres-prod
# Interactive vault connection
dbcrust vault:///
DBCrust provides comprehensive Python integration with multiple approaches for different use cases. Whether you're building automation scripts, analyzing Django applications, or integrating database operations into your Python workflow, DBCrust has you covered.
import dbcrust
# Execute SQL queries
result = dbcrust.run_command("postgres://user:pass@localhost/mydb", "SELECT * FROM users LIMIT 10")
print(result)
# Execute backslash commands
tables = dbcrust.run_command("postgres://user:pass@localhost/mydb", "\\dt")
databases = dbcrust.run_command("postgres://user:pass@localhost/mydb", "\\l")
# Multi-database support
mysql_result = dbcrust.run_command("mysql://user:pass@localhost/mydb", "SHOW TABLES")
sqlite_result = dbcrust.run_command("sqlite:///path/to/database.db", "SELECT * FROM users")
import dbcrust
# Execute with additional CLI options - perfect for automation
result = dbcrust.run_with_url(
"postgres://user:pass@localhost/mydb",
["--debug", "-c", "\\dt"]
)
# Use saved sessions without sys.argv conflicts
dbcrust.run_with_url("session://production", ["-o", "json", "-c", "SELECT version()"])
# Clean programmatic calls for integration
dbcrust.run_with_url("docker://postgres-container/mydb")
import dbcrust
# Launch interactive CLI
dbcrust.run_cli("postgres://user:pass@localhost/mydb")
# Or without specifying URL (will prompt for connection)
dbcrust.run_cli()
from dbcrust import PostgresClient
# Connect to database
client = PostgresClient(
host="localhost",
port=5432,
user="postgres",
password="secret",
dbname="myapp"
)
# Execute queries
results = client.execute("SELECT * FROM users LIMIT 10")
print(results)
# List operations
databases = client.list_databases()
tables = client.list_tables()
# Use the new run_command method
result = client.run_command("SELECT COUNT(*) FROM users")
DBCrust includes a powerful Django ORM analyzer that detects performance issues:
from dbcrust.django import analyzer
# Analyze Django ORM queries for performance issues
with analyzer.analyze() as analysis:
# Your Django code here
books = Book.objects.all()
for book in books:
print(book.author.name) # Will detect N+1 query
# Get results
results = analysis.get_results()
print(results.summary)
# Django management command integration
python manage.py dbcrust # Connect to default database
python manage.py dbcrust --database analytics # Connect to specific database
Features:
select_related()
and prefetch_related()
python manage.py dbcrust
works like dbshell
but with DBCrust featuresPerfect for:
📖 Complete Django Analyzer Documentation →
DBCrust provides 40+ interactive commands for database management, query optimization, and developer workflows.
Quick examples:
\l
- List databases\dt
- List tables\d users
- Describe table structure\e
- Toggle EXPLAIN mode for query analysis\docker
- List Docker database containers📖 Complete Command Reference →
Configure automatic SSH tunnels in your config file:
[ssh_tunnel_patterns]
"^db\\.internal\\..*\\.com$" = "jumphost.example.com"
".*\\.private\\.net" = "user@jumphost.example.com:2222"
Set up Vault integration:
export VAULT_ADDR="https://vault.example.com"
export VAULT_TOKEN="your-token"
dbcrust vault://my-role@database/postgres-prod
DBCrust stores configuration in ~/.config/dbcrust/config.toml
:
[database]
default_limit = 1000
expanded_display_default = false
[ssh_tunnel_patterns]
"^db\\.internal\\..*\\.com$" = "jumphost.example.com"
DBCrust can connect to databases running in Docker containers:
# Connect to a specific container
dbcrust docker://postgres-container
# Interactive container selection
dbcrust docker://
# With credentials and database
dbcrust docker://user:pass@container-name/dbname
Features:
dev.orbstack.domains
labelservice.project.orb.local
We welcome contributions! Please see our Contributing Guide for details.
git clone https://github.com/clement-tourriere/dbcrust.git
cd dbcrust
cargo build
cargo test
cargo test -- --nocapture
This project is licensed under the MIT License - see the LICENSE file for details.
FAQs
High-performance database CLI and Python library with Django ORM analysis, SSH tunneling, and multi-database support (PostgreSQL, MySQL, SQLite)
We found that dbcrust demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.