Particle-1 and GPT-6 Luna Pro Build Tilda Search Backend on n8n, PostgreSQL and Docker

A practical case study demonstrates how a fast, lightweight model and a slower reasoning model can be combined to implement a production search feature for a password-protected Tilda page backed by n8n, PostgreSQL 16 and Docker.

The developer assigned Particle-1 the role of “hands” inside VS Code (Cline), letting it write and iteratively patch SQL and JavaScript after each execution error. GPT-6 Luna Pro was reserved for the “brain” role and activated only when the problem required rethinking data-flow contracts or array-handling strategy rather than simple syntax fixes.

The functional requirement was straightforward: accept a POST body containing chosen spheres and gender, return up to five catalog rows ranked by the number of matching tags, with gender priority and cardinality tie-breakers, while guaranteeing that no LLM inference occurs at runtime. All ranking logic therefore lives inside a single PostgreSQL query executed by an n8n Postgres node.

Five distinct obstacles surfaced during development. The first was PostgreSQL’s lack of a native & operator for text[] arrays; the correct approach combined an && existence check in the WHERE clause with a correlated subquery that counts matches via unnest. The second obstacle was a data-contract mismatch between an n8n Code node and the subsequent Postgres node, producing an undefined value inside the generated query. The third involved incorrect quoting of PostgreSQL array literals, which was eventually solved by embedding the literal directly in the SQL string. The fourth problem lay not in the query itself but in the Respond to Webhook node, which by default emits only the first item; switching to “All Incoming Items” finally delivered the full result set. The fifth issue was discovered in the source data: only one record carried the “female” gender value, prompting the addition of explicit gender-inheritance rules rather than attempts to correct 1 684 rows.

After all functional fixes, a manual security review revealed a remaining SQL-injection flaw. Although backslashes and double quotes were escaped, single quotes were not, allowing an attacker who knew the webhook URL to break out of the array literal and alter the query. The finding underscores that even when LLMs generate the bulk of the code, final security validation must still be performed by a human.