1. A data leak protection method comprising: receiving a database query; producing metrics, by an intrusion detection system (IDS), for said database query; receiving the result set produced by said database query; and limiting a response to said database query based upon: a shape of said result set produced by said database query, said metrics, and a data leak protection policy specifying a set of limitations for a corresponding set of shapes and metrics.