Atalaya — Spanish for "watchtower". A high vantage point with a clear view over the territory below.
The uncomfortable question
Open VSCode. Search "SQLite". Pick the most popular extension. Run find node_modules -type d | wc -l after installing it locally. Most of them sit somewhere between 200 and 500 packages in their transitive dependency tree, plus native code bundled per platform.
For a tool whose single job is to read a .db file.
[TODO: drop a personal anecdote here — when did supply-chain risk in editor extensions stop being abstract for you? a coworker affected, a compromised package you remember, the recent xz-utils backdoor narrative, whatever feels honest. one paragraph max.]
When that's the surface a tool sits on, every extension you install is a trust decision you're making against your entire workspace: source code, environment variables, git credentials, the lot. And the threat is not theoretical — compromised VSCode extensions have shipped credential-stealers to thousands of developers in the last two years.
So I built one I could actually audit.
Meet Atalaya
, the official SQLite compiled to WebAssembly After It's not Monaco. It doesn't do alias resolution or syntax highlighting. That's the point. You can read every line of it. and
Zero native modules — no node-gyp, no platform-specific compilation
Zero network calls, zero telemetry, zero remote resource loading
Strict CSP in the webview (default-src 'none' + per-load cryptographic nonce)
All SQL identifiers are allowlist-validated; all SQL values bound via prepared statements
MIT licensed, ~2,300 lines of code total
FROM, JOIN, INTO, UPDATE it suggests tables. After SELECT, WHERE, AND, OR, ON, ,, ( and friends it suggests columns. Arrow keys navigate, Enter / Tab insert, Esc closes. Cmd+Enter runs the query — the popup never intercepts it.
Query results don't surprise you
Marketplace: , the VSCode Custom Editor API, and a refusal to add dependencies.
SOCIAL SHARE CARD GENERATOR