Fuzz-tested boundaries
Seeded fuzzing over every untrusted input: arbitrary SQL and hostile snapshots must produce a report or a clean parse error — never a crash.
The engine takes two kinds of untrusted input: SQL from anyone, and schema snapshots that were produced on someone else’s machine. Both are fuzzed with seeded generators in CI. Arbitrary byte sequences, truncated statements, absurdly nested expressions and hostile snapshots — wrong types, missing fields, gigantic counts — must all end in a report or a clean parse error. A crash is a failing test.
The seeds are fixed so a failure reproduces. New rules inherit the battery: a rule that walks the tree unsafely is caught before it ships, not by a customer.
The CLI is open source and needs no account: npx bolvrk check migration.sql
Also in Deterministic rule engine
- Postgres migration safety checks
- Real parse-tree analysis
- Severity taxonomy
- Evidence-backed rules
- False-positive discipline
- A corpus of 69 rules
- Credential rules: no secret ever reaches the repo
- Secret scanning for any file: bolvrk secrets
- Performance rules: indexing and query health
- Query verification: bolvrk explain