Real parse-tree analysis
libpg_query — the exact parser Postgres uses. Keywords inside strings or comments can never trigger a false alarm.
Bolvrk parses SQL with libpg_query, the Postgres parser lifted out of the server. Every rule walks the same syntax tree Postgres would execute, not a text buffer. A DROP TABLE inside a string literal, a comment, a dollar-quoted function body or a column named truncate_at is not a statement, and no rule will ever mistake it for one.
The same parser is why file-level context works: when several files are checked together, each one sees the tables, columns, indexes and foreign keys the earlier files declared — because the engine built them from the trees, not from guesses.
Never executed
Customer SQL is parsed and never run. The hosted service holds no execution path for a migration: what arrives is turned into a tree, judged, and reported. The only place a statement of yours touches a database is bolvrk explain on your own machine, in a read-only transaction, and only through EXPLAIN.
The CLI is open source and needs no account: npx bolvrk check migration.sql
Also in Deterministic rule engine
- Postgres migration safety checks
- Severity taxonomy
- Evidence-backed rules
- False-positive discipline
- Fuzz-tested boundaries
- A corpus of 69 rules
- Credential rules: no secret ever reaches the repo
- Secret scanning for any file: bolvrk secrets
- Performance rules: indexing and query health
- Query verification: bolvrk explain