SqueakQL security

SqueakQL uses PostgreSQL-inspired expression syntax but is not SQL and does not provide direct database access.

• Hamstik parses and validates each query against its supported language.
• Only documented Work Item fields, operators, and functions are available.
• SQL statements and database access are not part of SqueakQL.
• Every query is intersected with your existing organization, membership, Project, and Personal Access Token resource permissions.

CURRENT_USER is resolved from the authenticated Hamstik request. It cannot impersonate another user. A query cannot remove authorization predicates or expand the Projects it can see.

Quoted text remains a search value. It cannot become a database command.