Payload transparency

--show-payload prints the exact request body and exits without sending. Enforced by tests: a planted secret row value can never appear in a snapshot.

You should not have to trust a description of what a tool sends. --show-payload prints the exact request body a --remote check would send — the migration text, the snapshot, the repository ignores — and exits without sending it. Run it once, read it, and put it in the security review.

The claim that a snapshot holds structure only is enforced, not asserted: the engine’s test suite plants a secret value in a row of a fixture database and fails if that value appears anywhere in the snapshot. The introspection queries are pinned by an isolation test too — every statement is a read against the catalogs, and a change that adds anything else fails the build.

npx bolvrk check migration.sql --db=$SHADOW_DB --remote --show-payload

Also in Live-schema context

• Schema-aware escalation
• Hot-table awareness
• Credential-free cloud checks
• Stored connections
• Protected databases