Credential-free cloud checks

The CLI introspects the database it already has access to and pushes only structure. Our cloud never holds a database credential. Hosted, Startup and above.

The default way to give the hosted service live-schema context is to not give it your database at all. The CLI, running where it already has access, introspects the catalogs and sends the structure along with the migration. The service judges the SQL against that snapshot. No connection string ever reaches us, and there is nothing to breach.

Stored connections exist for teams that want zero-setup CI, and they are sealed-box encrypted and read-only — but credential-free is the path the product is built around.

BOLVRK_TOKEN=blv_... npx bolvrk check migration.sql --db=$SHADOW_DB --remote

Also in Live-schema context

• Schema-aware escalation
• Hot-table awareness
• Payload transparency
• Stored connections
• Protected databases