Real parse-tree analysis
libpg_query, the exact parser Postgres uses. Keywords inside strings or comments can never trigger a false alarm.
Bolvrk parses SQL with libpg_query, the Postgres parser lifted out of the server. Every rule walks the same syntax tree Postgres would execute, not a text buffer. A DROP TABLE inside a string literal, a comment, a dollar-quoted function body or a column named truncate_at is not a statement, and no rule will ever mistake it for one.
The same parser is why file-level context works: when several files are checked together, each one sees the tables, columns, indexes and foreign keys the earlier files declared, because the engine built them from the trees, not from guesses.
Never executed
Customer SQL is parsed and never run. The hosted service holds no execution path for a migration: what arrives is turned into a tree, judged, and reported. The only place a statement of yours touches a database is bolvrk explain on your own machine, in a read-only transaction, and only through EXPLAIN.
The CLI is open source and needs no account: npx bolvrk check migration.sql
Also in Deterministic rule engine
- Postgres migration safety checks
- Severity taxonomy
- Evidence-backed rules
- False-positive discipline
- Fuzz-tested boundaries
- A corpus of 69 rules
- Credential rules: no secret ever reaches the repo
- Secret scanning for any file: bolvrk secrets
- Performance rules: indexing and query health
- Query verification: bolvrk explain