# Safe mode, read-only mode and the console

Safe mode asks before the app runs a statement, read-only mode refuses to write, the console lists every statement the app runs, and the process list shows what the server is doing.

## Where to find it

| Action | How |
| --- | --- |
| Change safe mode | The safe mode button near the right end of the status bar, or `Safe mode` in the connection form |
| Make a connection read-only | `Open in read-only mode` under `Security and safety` in the connection form |
| Open the console | `⌘⇧C` (`Ctrl+Shift+C`), or `View` > `Toggle Console` |
| Open the process list | `⌘.` (`Ctrl+.`) while no query is running |
| Reconnect | `Reconnect` in the status bar |

## Safe mode levels

`Off` runs statements without asking, `Warn Writes` asks before anything that changes data or structure, and `Warn All` also asks before reads such as a `SELECT`. The prompt, `Run these statements?`, shows the connection and the full SQL with `Cancel` and `Run`. The app classifies each statement in its native layer, a batch counts as its most dangerous statement, and a statement it does not recognise counts as a write. Prompts cover SQL you run in the editor, committed edits and structure changes, imports and process actions, while browsing, sorting and filtering a table never ask.

## Turning a prompt off

`Don't ask again` in the prompt offers `For this session`, which lasts until you reconnect, and `Always for` followed by the connection name, which saves the change to the connection. Either choice lowers safe mode only as far as needed: a prompt for a read moves the connection to `Warn Writes`, a prompt for a write turns it `Off`, and a notice points you to the status bar to change it back. A connection tagged Production, or one that is not saved, can only change for the session. Dropping or truncating from the sidebar and terminating a server process always ask, and their prompts cannot be turned off.

## Read-only connections

A read-only connection refuses every statement the app does not classify as a read before it reaches the server, and the server session is read-only as well where the engine allows it:

- PostgreSQL and CockroachDB set `default_transaction_read_only`.
- MySQL and MariaDB set a read-only session transaction.
- SQLite opens the file read-only.
- ClickHouse and Snowflake refuse write statements in the driver.
- TiDB, Oracle and SQL Server rely on the app's check.

The status bar shows `READ-ONLY`, the grid reads `This connection is read-only, so table data cannot be edited.`, and disabled controls explain `Connection is read-only` on hover.

## The console

`⌘⇧C` opens `Console`, which lists every statement the app sends for the active session with its time, a `USER` or `META` label, the SQL, its duration, and the rows returned or the error. `USER` statements are the ones you run or commit, and `META` statements are the catalog and page queries the app runs for you. The `All`, `User` and `Meta` buttons and the `Filter SQL or errors` box narrow the list. Click a failed statement to read its error, right-click any statement for `Copy SQL` or `Open in editor`, and choose `Clear` to empty the list for this session.

## Processes

Press `⌘.` while no query is running to open the process list for the active connection, such as `PostgreSQL processes`. It shows each server process with `PID`, `USER`, `DATABASE`, `APPLICATION`, `CLIENT`, `STATE`, `STARTED`, `DURATION` and `QUERY`, refreshes while it is open, and dims the app's own connections. `Cancel query` stops a running statement and follows safe mode, while `Terminate` ends the connection and always asks first. The list is available on PostgreSQL, MySQL, MariaDB, TiDB, SQL Server, ClickHouse and Snowflake, and ClickHouse and Snowflake offer `Cancel query` only.

## Reconnecting

When a connection drops, the status bar reads `Disconnected, reconnecting...` with the attempt number and the wait before the next try, and the app reconnects on its own. It waits longer between attempts, up to 30 seconds, and after ten minutes it stops and shows `Reconnect stopped`. An idle connection is checked every 30 seconds so a drop is noticed before you need it, and a restored workspace whose session has expired reconnects before its first read. `Reconnect` in the status bar opens a fresh session at any time, and a workspace that has lost its session shows a second `Reconnect` beside the connection name.

## Good to know

- New connections start at `Warn Writes`. A level chosen in the status bar applies to the current session; set `Safe mode` in the connection form to keep it.
- The console lives in memory and keeps up to 5,000 statements across open sessions.
- SQLite, CockroachDB, Oracle and Cloudflare D1 have no process list.
- Native workspaces for Redis, MongoDB, Cassandra, Cloudflare KV and BigQuery apply safe mode and read-only mode before they run a command. See [Redis](https://bobbytables.app/docs/redis) and [MongoDB](https://bobbytables.app/docs/mongodb).
- Approving a write from a coding agent is separate from safe mode and always required. See [agents](https://bobbytables.app/docs/agents).

## Related

- [Editing rows](https://bobbytables.app/docs/editing.md)
- [SQL editor](https://bobbytables.app/docs/sql-editor.md)
- [Connections](https://bobbytables.app/docs/connections.md)