Take away the credentials, keep the capability
Engineers hold production database passwords for a reasonable motive: support and debugging need real data. Revoking access without replacing it just moves the work to whoever still has a login. The fix is a governed way in, not a locked door.
Why credential sprawl persists
Support work needs real rows
Diagnosing a customer problem usually means looking at that customer's actual data. No amount of synthetic test data answers "why is this specific invoice wrong".
The DBA becomes a queue
Routing every read-only question through one person protects the database and creates a bottleneck that everyone is motivated to route around.
Shared logins erase attribution
When a team shares one connection string, the database records the account, not the human. Access review becomes guesswork.
Read access drifts into write access
Credentials granted for investigation are the same credentials available at 2am when someone decides to fix the data directly.
A governed way into the data
Engineers browse tables, preview rows, and run queries against production without the ability to modify anything unless that permission is granted explicitly.
The same person can hold full rights on DEV and read-only on PROD. Access matches the risk of the environment instead of being all-or-nothing across the estate.
Because people sign in as themselves rather than sharing a database account, the log records which person ran which query against which environment.
Natural language query generation (OpenAI-backed) lets a support engineer ask a question in plain English and get SQL, with risk analysis applied before anything runs.
The credentials never leave your network
Explorer does not work by giving Migratrix your database passwords. Access runs through an Executor you deploy inside your own perimeter.
Run it via Docker, Homebrew, or a native installer on Linux, macOS, or Windows, in the network segment closest to the databases it manages.
Database credentials can be rotated on the Executor without interrupting the platform, and optional just-in-time credentials can come from your own secret manager.