warning
hosted, paid — --remote
Write privileges granted to PUBLIC
Warning — this works, but blocks traffic or rewrites data at scale.
What it catches
GRANT ... TO PUBLIC applies to every role the cluster has now — and every role created later, forever. Granting write privileges (or ALL) on a table to PUBLIC turns one migration line into a standing policy that no future account can be excluded from.
Fires on
GRANT ALL ON orders TO PUBLIC;Do this instead
Grant to the specific role that needs the access — service roles for writes, a read-only role for reporting. PUBLIC is every current and future role; a named role is a decision you can see and revoke.
GRANT SELECT ON orders TO reporting;
GRANT INSERT, UPDATE ON orders TO orders_service;Catch this before it ships
This rule runs in the hosted service on Startup and above — add --remote with a team token, or use the GitHub Action: npx bolvrk check migration.sql