# Verifying SQL changes Files: `.sql`. Derived from 0 scanned source repositories and 17 review prompts on https://awesomereviewers.com. Page: https://awesomereviewers.com/verify/sql/ How to use this: run every check under *Run on every change*. Then, for each section under *Add when the change touches* that describes your diff, run its checks too. Checks catch what a tool can find; then apply the listed review prompts for what tools miss (fetch each prompt's raw URL). Usage is the share of scanned repositories in this language that run the tool. A missing tool means no scanned repository runs one the scanner recognises: fall back to the prompts. ## Run on every change - **Formatting** — no tool detected in the sample. Catches: Layout drift that buries the real change in the diff. - **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover. - **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules. - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. Review prompts (1 in total, most discussed first): - [Consistent database naming](https://awesomereviewers.com/raw/langfuse-consistent-database-naming.md) — langfuse/langfuse, Naming Conventions ## Add when the change touches ### Authentication, input handling, secrets, permissions - **Security scanning** — no tool detected in the sample. Catches: Injection, unsafe APIs and tainted data reaching a sink. - **Secret scanning** — no tool detected in the sample. Catches: Credentials and tokens committed to the repository. - **Dependency audit** — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses. Review prompts (3 in total, most discussed first): - [Escape SQL parameters](https://awesomereviewers.com/raw/neon-escape-sql-parameters.md) — neondatabase/neon, Security - [Least-privilege database grants](https://awesomereviewers.com/raw/helicone-least-privilege-database-grants.md) — Helicone/helicone, Security - [Encrypt sensitive credentials](https://awesomereviewers.com/raw/langfuse-encrypt-sensitive-credentials.md) — langfuse/langfuse, Security ### Public APIs, signatures, error paths, nullability - **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules. - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data. ### Service and framework code - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally. ### Algorithms, parsers, data transforms - **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data. - **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders. - **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does. - **Proofs and specifications** — no tool detected in the sample. Catches: Design-level bugs in protocols and algorithms, checked against a specification. ### Threads, async code, locks, shared state - **Concurrency model checking** — no tool detected in the sample. Catches: Races and orderings that fail only under specific interleavings. - **Undefined-behaviour detection** — no tool detected in the sample. Catches: Memory-safety and aliasing violations in unsafe code. - **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data. ### Network calls, retries, timeouts, protocols - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders. ### UI components and pages - **End-to-end browser tests** — no tool detected in the sample. Catches: User flows broken across components, routing and the network. - **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover. ### Databases, migrations, caching - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. - **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally. Review prompts (11 in total, most discussed first): - [Deliberate schema constraints](https://awesomereviewers.com/raw/helicone-deliberate-schema-constraints.md) — Helicone/helicone, Migrations - [Transactional verified migrations](https://awesomereviewers.com/raw/inbox-zero-transactional-verified-migrations.md) — elie222/inbox-zero, Migrations - [Use idempotent migrations](https://awesomereviewers.com/raw/lobe-chat-use-idempotent-migrations.md) — lobehub/lobe-chat, Migrations - [enforce database constraints properly](https://awesomereviewers.com/raw/mono-enforce-database-constraints-properly.md) — rocicorp/mono, Database - [Database type best practices](https://awesomereviewers.com/raw/inbox-zero-database-type-best-practices.md) — elie222/inbox-zero, Database - [Database migration best practices](https://awesomereviewers.com/raw/langfuse-database-migration-best-practices.md) — langfuse/langfuse, Migrations - [Use defensive SQL clauses](https://awesomereviewers.com/raw/hyperswitch-use-defensive-sql-clauses.md) — juspay/hyperswitch, Migrations - [explicit database constraints](https://awesomereviewers.com/raw/hyperswitch-explicit-database-constraints.md) — juspay/hyperswitch, Database - [Comprehensive database testing](https://awesomereviewers.com/raw/clickhouse-comprehensive-database-testing.md) — ClickHouse/ClickHouse, Database - [Size fields appropriately](https://awesomereviewers.com/raw/vitess-size-fields-appropriately.md) — vitessio/vitess, Database - [Materialize database indexes](https://awesomereviewers.com/raw/langfuse-materialize-database-indexes.md) — langfuse/langfuse, Database ### Model, prompt and LLM code - **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise. ### CI workflows and configuration files - **CI workflow linting** — no tool detected in the sample. Catches: Broken GitHub Actions syntax, script injection, over-broad token permissions. - **File hygiene** — no tool detected in the sample. Catches: Invalid JSON, YAML or TOML, merge markers, trailing whitespace, oversized files. ### Dependencies and lockfiles - **Dependency audit** — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses. - **Lockfile consistency** — no tool detected in the sample. Catches: A lockfile that no longer matches its manifest. - **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally. ### The tests themselves - **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does. - **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally. Review prompts (2 in total, most discussed first): - [comprehensive test coverage](https://awesomereviewers.com/raw/spark-comprehensive-test-coverage.md) — apache/spark, Testing - [Write focused, clear tests](https://awesomereviewers.com/raw/clickhouse-write-focused-clear-tests.md) — ClickHouse/ClickHouse, Testing ### Documentation and comments - **Docs build** — no tool detected in the sample. Catches: Broken cross-references, links and markup in documentation. - **Spelling** — no tool detected in the sample. Catches: Typos in identifiers, comments and docs.