Quick answer: The desktop connects to the database through saved profiles whose passwords are never returned, and it runs a read-only SELECT with a bounded row set through database.runSelect . Writes and DDL are blocked, so the software can read the live tables and keys for reconciliation but cannot modify the storage.

Why access is read-only

Reconciliation needs a real baseline, and that means reading the live tables and enforced keys rather than a guessed schema. It does not require writing, and giving a modeling tool write access would add a risk that the feature does not need.

Keeping the connection read-only lets the desktop observe the database while removing the chance that a generated or exploratory change reaches the storage.

The safety controls

Control Behavior

Saved profiles Connections are stored, passwords are never returned

runSelect Runs a read-only SELECT with a bounded row set

Writes Blocked

DDL Blocked

Row set Bounded so a query cannot return an unbounded result

The bounded row…