Step one of one
Connect a database Give it a role that can read the catalog. The trace opens one session, reads the catalog, and closes — your credentials exist in server memory for the length of that request and are never stored. Nothing is written back to the database.
No database to hand? Open the example trace — an invented warehouse schema that exercises every part of the workspace.
Make a read-only role first Run this on the target database as a superuser. The trace needs nothing beyond SELECT, and giving it nothing beyond SELECT is the point.
CREATE ROLE lineage_reader LOGIN PASSWORD 'choose-something-long';
GRANT CONNECT ON DATABASE your_database TO lineage_reader;
GRANT USAGE ON SCHEMA public TO lineage_reader;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO lineage_reader;
-- Optional. Without it the trace still maps the schema,
-- it just has no query timings to show.
GRANT pg_read_all_stats TO lineage_reader; Before you paste The host has to be reachable from the internet. This app runs on Vercel, whose functions have no fixed outbound IP address, so a database behind an IP allow-list will time out rather than connect.TLS is on by default. A connection string without an sslmode is treated as sslmode=require: encrypted, with the certificate chain unverified — the same thing libpq does, and what hosted Postgres connection strings assume. Add ?sslmode=verify-full to verify the certificate.Large catalogs are capped. A trace covers the first 300 readable relations in schema and name order and says so on the workspace when it has stopped short.Tracing is rate-limited. Six traces and twenty connection tests a minute from one address, counted per server instance, because each one makes this server open an outbound connection.What gets stored The finished snapshot — table names, column names and types, foreign keys, row estimates and any query text pg_stat_statements returned — is saved in this browser’s localStorage. Credentials are not part of the snapshot and are not saved anywhere. There is no account, so a trace does not follow you to another browser; export it as JSON or make a share link if you need it elsewhere.