I came across Query Reporter on a previous occasion as a potential tool for some of our users to allow them access to the database without having the ability to edit data. During testing, we found that you could put an Update statement in the SQL window and actually alter data. My IT manager also tried a Drop Table command and was able to do that.

I just tried you latest version and was able to create a table, truncate the records and drop the table. It's not exactly what we would like users to be able to do.

Is there any setting that can be changed to only allow selects?

If you send an e-mail to support@allroundautomations.com, this can be arranged.

If you create a user with read-only rights to the database and use that user/pw combo to execute the queries in Query Reporter, you should be safe, isn't it?

Yes, you can use the Oracle object privileges, system privileges, and role privileges to secure your database.