I built an open-source NL2SQL engine in .NET 10 & Angular 21 with AST-level security guardrails and column masking

Hey everyone!

Over the past few weeks, I’ve been working on InsightFlow — a Natural Language to SQL engine, Web API, and Studio interface built on .NET 10 and Angular 21.

Most Text-to-SQL tools just pass prompts directly to LLMs, which introduces major SQL injection and data-leak risks. To solve this, I focused heavily on security guardrails before any query executes:

• AST Mutation Blocking: Uses AST parsing to strictly reject any non-SELECT query (DROP, DELETE, UPDATE, INSERT) before it ever hits the database.
• Column-Level Masking: Prevents sensitive fields (PasswordHash, SSN, credit cards) from being exposed to the prompt context or API payloads.
• Auto Chart Synthesis: Automatically analyzes the returned dataset and dynamically renders visualization specs for the Angular UI.

🛠 Tech Stack:

• Backend: .NET 10 (Web API + Core Engine SDK)
• Frontend: Angular 21 (Studio UI)
• Infrastructure: Docker, Docker Compose
• LLM Integration: OpenRouter / OpenAI API

🔗 Links & Getting Started:

• GitHub Repo: https://github.com/codewithkarannn/insightflow
• Try with Docker: docker compose up

I’d love to get feedback from the community on the architecture and security approach. Pull requests and feature suggestions are welcome!