This is indeed a fascinating read. What I'd love to have is a "how can I spot this happening with my queries in production"? Most libraries I've used as an API

This is indeed a fascinating read. What I'd love to have is a "how can I spot this happening with my queries in production"? Most libraries I've used as an API developer prepare queries, it's a great peace of mind for SQL injection attacks where you're dealing with user input - so this could be happening in my app and I wouldn't even know about it! What do you think the downside of just defensively enabling force_custom_plan is, if any?