This is actually solvable. The queries that will be executed by an app can be analysed statically, and therefore are available as part of a build pipeline. So it&#x27;s possible to create a whitelist of queries automatically, or even go one step further and give each query a short unique ID and just say &quot;execute query foo with these parameters&quot; rather than sending the actual body of the query over the network.