Bolvrk
Sign in Open app

Bring trust to the development workflow —
no matter who, or what, makes the changes.

Bolvrk is the deterministic verification layer between any author, human or AI agent, and your production Postgres — dangerous changes and committed credentials caught before they ship. The CLI is open source (MIT); the full corpus runs in the cloud.

Sign in with GitHubExplore the features
npx bolvrk check migration.sql
01 — On the pull request

A PR opens. Rules judge it. The findings land in review.

The migration in the PR
migrations/0042_orders_region.sql
ALTER TABLE orders
  ADD COLUMN region text NOT NULL;
CREATE INDEX idx_orders_region
  ON orders (region);
The rules that fire
BV002 NOT NULL column without a default
BV003 Index built without CONCURRENTLY
BV034 No lock_timeout guard

66 other rules in the hosted service checked this migration on a paid plan — and stayed silent.

What we answer
bolvrkcommented on the PR
critical
 Fails on any populated table — add the column nullable, backfill, then SET NOT NULL.
warning
 The index build blocks every write to orders — use CREATE INDEX CONCURRENTLY in its own migration.

3 findings · exit 1 — one evolving comment, not a pile.

02 — Why now

AI writes more of your change stream every quarter

AI opens the pull requests and writes the migrations now — review capacity hasn't kept up. Verification is the missing layer: judge the change, not the author. Your model proposes; our deterministic checker decides — no AI, ours included, is ever part of the verdict. Postgres migrations first, because nothing hurts a business faster from within. More surfaces are on the roadmap.

03 — Workflow

Three layers of defense

  1. Check locally

    npx bolvrk check — the open-source, MIT-licensed CLI — runs the free outage rules over the real Postgres parse tree before the migration ever leaves your machine.

  2. Gate every pull request

    The GitHub Action checks changed migrations and comments the findings where review happens — free rules on the Free plan, the full corpus on Startup and above. Connect a database and it checks against your live schema: table sizes, foreign keys, column types.

  3. Trust the pipeline, whoever writes it

    Point any AI workflow at bolvrk check and every generated migration gets a deterministic verdict before it ships — AI is never part of the verdict. Every connected run is logged: your system of record for what went wrong and how often.

04 — The failure mode

The migration is fast. The queue behind it isn't.

A lock that takes milliseconds still parks every write behind it — and on a hot table the backlog is the outage. That's why Bolvrk reads your real schema's shape and traffic: the same ALTER is harmless on a quiet table and a production incident on a busy one, and a checker that can't tell the difference is just noise.

05 — Credentials

No secret ever reaches the repo

A migration that seeds an admin with password 'admin', a role created with its password inline, a connection string with the password embedded, a Stripe key in an INSERT — all committed, reviewed, printed by CI and kept in git history forever. The BC rules catch them before the commit, and every finding masks the value: the report never repeats a secret.

The same rules run over any file with bolvrk secrets — .env, YAML, JSON, source, shell. Published vendor formats only, never entropy guesses, so a uuid or a bcrypt hash stays silent. Always local: a credential scan never leaves your machine.

.env
DATABASE_URL=postgres://app:hunter2@db.internal/app
STRIPE_SECRET=sk_live_51H8zK2eZvKYlo2C…
JWT_SECRET=correct-horse-battery
npx bolvrk secrets ".env*" "src/**"
3 findings
BC003 critical  .env:1  connection string with an embedded password — postgres://app:***@db.internal/app
BC004 critical  .env:2  Stripe secret key in a literal — sk_live_***
BC006 warning   .env:3  JWT_SECRET given a literal value — ***
3 findings · exit 1 · nothing left this machine
06 — Rules

A rule corpus that earns its claims

Every rule ships with fixture migrations in both directions — dangerous variants that must fire, safe look-alikes that must stay silent. Lock and rewrite claims are proven against live Postgres: observed lock modes, observed rewrites. Credential rules match published secret formats, never guesses.

69rules and growing
2×fixtures per rule, both directions
13–17Postgres majors in the test matrix
BV002 NOT NULL column without a default 
ADD COLUMN region text NOT NULL;
BV003 Index built without CONCURRENTLY 
CREATE INDEX idx ON orders (region);
BV004 Type change forcing a table rewrite 
ALTER COLUMN id TYPE bigint;
BV007 Volatile default rewriting every row 
ADD COLUMN uid uuid DEFAULT gen_random_uuid();
BV011 SET NOT NULL scanning under full lock 
ALTER COLUMN region SET NOT NULL;
BV013 TRUNCATE in a migration 
TRUNCATE orders CASCADE;
BV014 UPDATE or DELETE without WHERE 
UPDATE orders SET region = null;
BV015 VACUUM FULL disguised as maintenance 
VACUUM FULL orders;
BV017 Foreign key with no covering index 
ADD CONSTRAINT fk FOREIGN KEY (user_id) ...;
BC001 Role password committed in plaintext 
CREATE ROLE app LOGIN PASSWORD 'hunter2';
BC004 API key or private key in a literal 
VALUES ('stripe', 'sk_live_51H8zK…');
Browse the full rule reference
07 — Why it holds

Deterministic, in an increasingly non-deterministic world

Real parser, never regex

Every rule runs over the actual Postgres parse tree. What parses in production parses in Bolvrk — and AI output never enters the verdict.

Checked against your schema

On a paid plan, findings are refined against your table sizes, foreign keys, and column types — read from catalogs in a read-only transaction, from the replica or shadow database you point us at. Findings about your database, not a hypothetical one.

Claims proven, not asserted

Every lock and rewrite claim is validated empirically against live Postgres in CI — observed lock modes, observed rewrites.

08 — The record

Every connected run, remembered

The cloud is your system of record: every check from every connected client lands in the run log, and Insights rolls it up — which rules fire most, how the clean-run rate trends, where the process is drifting. Recurring findings are process problems, not people problems; now they're visible.

09 — Pricing

The CLI and its rules are free and open source. Teams pay for the full corpus and live-schema context.

Startup

$49/monthexcl. VAT

Flat per team, never per seat — self-serve, no sales calls

  • Everything in Free
  • The full corpus — every rule, on every check
  • Live-schema (tier-2) refinement: table sizes, traffic, foreign keys
  • 2 stored connections for zero-setup CI
  • Insights — what goes wrong, how often, trending where
  • Checks still never metered
Set up your team

Scale

$199/monthexcl. VAT

For teams where migrations ship daily

  • Everything in Startup
  • Team policy: the block threshold and per-rule overrides, org-wide
  • 25 stored connections
  • AI migration review — advisory, never the verdict — 500 / month
  • Priority support
Start on Scale

Enterprise

Custom

Your limits, your terms

  • Everything in Scale
  • Custom connection & AI-review limits, set by us for you
  • Invoicing & procurement support
  • Direct line to the team
Talk to us

Free, forever

$0

For every individual and open-source project

  • Open-source CLI (MIT) with the same rules, locally
  • The free rules, in the cloud: run log, PR comments, notifications
  • Sign-in, team and tokens, the GitHub Action, findings feedback
  • Unlimited checks — validation is never metered
Install the CLI

Full pricing details and FAQ →