I built an open-source NL2SQL engine in .NET 10 & Angular 21 with AST-level security guardrails and column masking

Hey everyone! 

Over the past few weeks, I’ve been working on InsightFlow — a Natural Language to SQL engine, Web API, and Studio interface built on .NET 10 and Angular 21.

Most Text-to-SQL wrappers just pass prompts directly to LLMs, which opens huge SQL injection and data-leak risks. To solve this, I focused heavily on security guardrails:                              

• AST Mutation Blocking: Uses AST parsing to reject any non-SELECT query (DROP, DELETE, UPDATE, INSERT) before it touches the database.                                                                 

• Column-Level Masking: Prevents sensitive fields (PasswordHash, SSN, credit cards) from being leaked into prompt context or API payloads.                                                              

• Auto Chart Synthesis: Analyzes the result dataset and dynamically renders visualization specs for Angular.

Stack: .NET 10 (Web API + Core Engine SDK), Angular 21 (Studio UI), Docker, OpenRouter / OpenAI API.                                                                                                  

GitHub Repo: https://github.com/codewithkarannn/insightflowTry with Docker: docker compose up                                                                                                       

I’d love to get feedback from the community on query validation approaches or feature requests!