Can We Replace A $150K Looker With A Bucket Of HTML Files?

TL;DR

Buying for a business?Offer from Amazon

Get business pricing on networking and server gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

David Lequin reports that a small internal service for sharing AI-generated HTML dashboards reached as many weekly users as Looker at his company, while Looker usage fell by about a third. The account describes a rapid prototype, a major security weakness, and a decision to develop the service into a more secure BI tool; it does not establish that Looker has been replaced or that the reported costs are independently verified.

David Lequin’s report describes how a data engineer at a company of about 500 people helped build an internal service for publishing AI-generated HTML dashboards that reached roughly as many weekly users as Looker within eight months. The project was built to make shareable dashboards easier to create, but its early security design had serious flaws, and the account says the team decided to develop it into a more formal BI tool rather than simply treat it as a finished replacement.

Lequin says his company paid about $150,000 a year for Looker, a figure he presents as an estimate based on an average licence and roughly 300 seats. The company’s data platform team had three engineers supporting a stack that included Snowflake, dbt, Airflow, Airbyte, DataHub and Kubernetes. In February, a colleague built a small service in an afternoon to host HTML files internally. The report says that, eight months later, the service had as many weekly users as Looker, possibly more, while Looker’s usage was down by about a third. Those are figures from Lequin’s account; the source gives no independent usage data or detailed measurement method.

The service let people use Claude to generate a dashboard as a single HTML file, then publish it through a small Python script to a service that stored files in S3 and required company sign-in. In March, the team added a live query API using the viewer’s Snowflake OAuth credentials, so queries ran with that person’s existing data access. Lequin says the team added email and Slack exports in April and parameters in May. Weekly viewers rose from 23 in March to 136 in June, according to the report. The numbers describe a single company and do not establish broader adoption or a comparison with Looker’s full user base.

Lequin says employees in finance, operations and marketing used the tool to create dashboards with flexible layouts and designs. But the early version let dashboard JavaScript run on the same origin as a user’s session, lacked dashboard-level permissions and allowed every employee to read every dashboard. The report characterizes this as a serious cross-site scripting risk: a malicious or unsafe dashboard could potentially act as the person viewing it and access data available to that person. The team later stopped treating the project as a joke and began planning a more secure BI tool, with a stated aim of preserving the existing S3 storage and easy publishing process.

A Faster Route to Custom Dashboards

The report highlights a practical challenge for BI software: users may value the ability to create and share a tailored analysis more than a standardized set of charts. Lequin says generated HTML pages looked better to colleagues than the company’s fixed-tile Looker dashboards and could be adjusted through prompts. That flexibility appeared to help adoption among employees who had not previously used technical tools to make dashboards.

It also illustrates a trade-off. A lightweight service can make it easier to publish useful analysis, but dashboards that execute code and query company data create security and governance risks. Lequin’s account says the prototype did not have a proper permission model and relied on existing network and sign-in controls. The project’s popularity did not remove those risks; it made addressing them more urgent. For organizations weighing BI costs, the case is a report of internal experimentation, not evidence that a hosted HTML service can safely replace a commercial platform in general.

From Generated Pages to Shared Reports

Lequin says early attempts at “chat with your data” tools had worked on small demonstration datasets but produced incorrect numbers at the company’s scale. He attributes a later change to Claude Code with Opus 4.5, which, in his account, could work within the company’s repositories and tools and run queries to check results. The report does not provide a formal benchmark or independent evaluation of that model’s accuracy.

The immediate problem was distribution: AI-generated dashboard files initially remained in users’ downloads folders or were sent through Slack. The internal hosting service gave those files shareable links. The team then connected the dashboards to Snowflake, using its existing roles to determine what each viewer could query. Lequin says the team wanted to retain the simple publishing workflow while improving protections, without requiring users to migrate existing dashboards.

“Security, at this point, was bad. Like, really bad.”

— David Lequin, describing the team’s early security assessment

Security Fixes and Adoption Still Unclear

The supplied account does not say what security changes were completed, whether the team launched a redesigned service, or whether the new system ultimately replaced Looker. It also does not provide independent confirmation of the reported licence cost, usage figures, or the claim that weekly users matched or exceeded Looker’s. The timeframe is described through months and an eight-month period, but no publication date is supplied.

It remains unclear how the planned tool would handle review of uploaded HTML, dashboard ownership, access controls, audit logs, or protections against unsafe scripts. Lequin says the team wanted to preserve a workflow in which users could publish HTML without a review step, template or other friction, but the source text ends before explaining how that requirement would be reconciled with the known security risks. The report also does not quantify maintenance costs or compare the full capabilities of the service with Looker.

The Team’s Security Redesign

In the account, the next step is to design a safer BI tool while keeping the S3-based storage and simple publishing flow that employees already used. The team had begun discussing the security model and agreed that existing users should not face a disruptive migration. The report does not give a launch date, a completed redesign, or a decision to cancel Looker.

The key milestone to watch is whether the team can keep publishing easy while preventing dashboard code from accessing data or sessions beyond a viewer’s authorization. Until the company reports the changes and their results, the project is best understood as a promising but unfinished internal system, not a demonstrated one-for-one replacement for a commercial BI platform.

Key Questions

Did the company replace Looker?

The source does not say that Looker was replaced. It reports that the internal tool reached about as many weekly users as Looker, possibly more, while Looker usage fell by roughly a third.

What did the internal tool do?

It hosted AI-generated HTML dashboards and gave employees shareable links. After a live query API was added, dashboards could query Snowflake using the viewer’s credentials.

How much did Looker cost in this account?

Lequin estimates the company’s Looker licence at about $150,000 a year for roughly 300 seats. The report does not provide invoices or independent verification of that estimate.

What was the main security problem?

Lequin says dashboard JavaScript ran on the same origin as a user’s session, there were no dashboard-level permissions, and employees could read every dashboard. He warned that a dashboard could potentially act as its viewer and access data available to that person.

What happens to the project next?

The team planned to formalize the service as a BI tool and improve its security while preserving easy publishing and existing storage. The supplied account does not describe a finished redesign or a release date.

Source: hn