There is a potential security vulnerability in the codebase related to SQL injection. Specifically, object keys (paths) are being used directly in SQL queries without proper escaping or parameterization. This could allow attackers to inject malicious SQL through crafted object keys.

Suggested Fix:

• Audit all places where object keys are used to construct SQL queries.
• Ensure that all object keys are properly escaped or, preferably, parameterized.
• Add tests to verify that SQL injection is not possible via object keys.

Action Items:

1. Identify all instances in the codebase where object keys are interpolated into SQL queries.
2. Refactor these queries to use parameterized statements or proper escaping mechanisms.
3. Add or update tests to cover these cases and prevent regressions.

cc @aalexfvk

I created this issue for @NikitaUnisikhin from #352 (comment).