Reading the docs it looks like if you have a read-replica of your primary database you could set `EXPLORER_CONNECTIONS` to only contain the read-replica and ach

Reading the docs it looks like if you have a read-replica of your primary database you could set `EXPLORER_CONNECTIONS` to only contain the read-replica and achieve some additional safety that way. Read replicas are pretty easy to set up with most managed database products (Cloud SQL, AWS RDS), so that would be a very lightweight way to add some ad-hoc querying capabilities in prod that won't keep you up at night.