False-positive discipline
A standing near-miss battery: safe SQL one token from every blocked pattern, asserted silent on every run. When we cannot prove a claim, we stay silent.
False positives kill trust faster than misses. For every dangerous pattern the corpus holds a near-miss: the safe statement one token away — the CONCURRENTLY that makes the index build fine, the binary-coercible type change that does not rewrite, the DEFAULT that Postgres 11+ stores in the catalog. Every near-miss is asserted silent on every run.
When a claim cannot be proven from the SQL and the catalogs, the rule stays quiet. Connect a database and the escalation logic silences lock and rewrite findings on tables it can prove are tiny or empty — most of the noise on the free tier is missing context, not wrong rules.
When it is still wrong
Every check page has “This finding is wrong”. Disputes are counted per rule in Insights, triaged, and become new near-miss fixtures. A correct finding you have chosen to accept is a different thing: mute it with a reason — inline, in the repository’s ignore map, or team-wide — so the next reader sees the risk was seen, not missed.
The CLI is open source and needs no account: npx bolvrk check migration.sql
Also in Deterministic rule engine
- Postgres migration safety checks
- Real parse-tree analysis
- Severity taxonomy
- Evidence-backed rules
- Fuzz-tested boundaries
- A corpus of 69 rules
- Credential rules: no secret ever reaches the repo
- Secret scanning for any file: bolvrk secrets
- Performance rules: indexing and query health
- Query verification: bolvrk explain