## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Feature - Security infrastructure
## What is the current behavior?
Analytics queries (BigQuery for legacy cloud, ClickHouse for self-hosted
OTEL) lack a compile-time safety model to prevent SQL injection from
untrusted input sources like URL parameters, UI inputs, or LLM output.
## What is the new behavior?
Implement a security model with a branded type `SafeLogSqlFragment` that
ensures all SQL fragments originate from either static code or
sanitization helpers. This includes:
- `analyticsLiteral()` for escaping string/number/boolean values
- `bqIdent()` and `clickhouseIdent()` for quoting identifiers with
engine-specific syntax
- `safeSql` template tag for composing fragments safely
- `executeAnalyticsSql()` wire boundary that rejects plain strings at
compile time
The pattern prevents cross-engine confusion by keeping
`SafeLogSqlFragment` (analytics) distinct from pg-meta's
`SafeSqlFragment` (Postgres).
## Additional context
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced analytics SQL execution capabilities with built-in safety
validation for queries.
* Enhanced query robustness through keyword and identifier validation
mechanisms.
* Improved error handling and reporting for analytics operations.
* **Tests**
* Added comprehensive test suite for analytics SQL safety and validation
utilities.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46287?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
