Secret-named column given a literal value
Warning — the name is the evidence: very likely a secret, reported so a human can decide.
What it catches
A column called password, api_key, secret or token that receives a literal in a DEFAULT, an INSERT or an UPDATE is a credential written into the migration by hand — the seeded admin account with password 'admin', the api_key DEFAULT 'changeme' that ships to every row. The name is the evidence, so this is a warning rather than a certainty: the rule stays silent on hashed values (bcrypt, argon2, SCRAM, pbkdf2), on empty strings and placeholders, and on names that merely contain the word (password_hash, token_type, api_key_id).
Fires on
INSERT INTO users (email, password) VALUES ('admin@example.com', 'admin123');Do this instead
Seed a hash, never the plaintext (and let the application own password hashing); for tokens and keys, seed nothing — or a placeholder the deploy substitutes — and have the value set at runtime. A DEFAULT on a secret column should be NULL or an empty string.
INSERT INTO users (email, password_hash) VALUES ('admin@example.com', '$2b$12$C6UzMDM.H6dfI/f/IKcEeO9rOsTbnR6Q3oFf9zGjHpMqU9ZAwK9Tu'); This rule runs locally in the free CLI — or with the full corpus through the hosted service: npx bolvrk check migration.sql