diff --git a/.changeset/sixty-kiwis-poke.md b/.changeset/sixty-kiwis-poke.md
new file mode 100644
index 0000000000..d4380cbd88
--- /dev/null
+++ b/.changeset/sixty-kiwis-poke.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+use parameterized query to prevent chance of SQL-injection