I thought of this when I first read the article title, and I think it's a decent compromise that mostly addresses the concerns in the other comments. Supporting

I thought of this when I first read the article title, and I think it's a decent compromise that mostly addresses the concerns in the other comments. Supporting truly arbitrary SQL seems too high-risk to allow from the front-end. PostgREST supports a simple subset in a HTML-like language that's fairly unlikely to have any unpredictable/negative consequences. I think it has limits for query time and result size built-in already too. You do have to get used to setting up the correct security constraints in Postgres natively though. Strangely enough, I hardly ever see anyone really use the Postgres security checks. Postgrest is pretty much the only use case I've ever heard of.