Builtin Rule Reference

This page lists all builtin rules that ship with Lexega. These rules are evaluated automatically unless disabled with --no-builtin.

Usage in policies: Reference any rule by its ID:

policies:
  - rule_id: SNW-STG-ENC-OFF  # Stage Encryption Disabled
    action: block
    envs: [prod]

Query Analysis (Q-xxx)

Rule IDRiskDescription
Q-JOIN-CROSS-CENH🟡 mediumCross join between {witness.left.name.raw} and {witness.right.name.raw} on a catalog-attested cartesian product of {witness.cartesian_estimate} rows. May cause performance issues on large tables. [Catalog-enhanced]
Q-SCAN-NOFILT🟡 mediumQuery reads multiple tables without an effective WHERE filter or LIMIT clause. This may cause full table scans.
Q-SCAN-1TBL🟡 mediumSELECT without an effective WHERE filter or LIMIT clause on table. May cause full table scan. Use tables.none_of to allowlist known-small tables.
Q-WIN-NOPART🟡 mediumWindow function without PARTITION BY operates over entire result set. This may cause performance issues or unexpected results.
Q-WIN-RANK-NOORD🟡 mediumROW_NUMBER/RANK/DENSE_RANK without ORDER BY produces arbitrary ordering. Results are non-deterministic.
Q-NULL-NOTIN🟠 highNULL-logic hazard: NOT IN with subquery on column '{witness.root.quantified_cmp.lhs.column.name.raw}'. If subquery returns any NULL, entire predicate evaluates to UNKNOWN and filters all rows. Use NOT EXISTS or ensure subquery has WHERE ... IS NOT NULL.
Q-PRED-CONTRA🔴 criticalContradictory equality: predicate can never be true (e.g., WHERE a=1 AND a=2). Query will return zero rows.
Q-PRED-RANGE🟠 highImpossible range: predicates define an empty range (e.g., WHERE x>10 AND x<5). Query will return zero rows.
Q-PRED-TAUTOLOGY🟡 mediumTautological predicate: condition is always true for non-NULL values (e.g., WHERE x=1 OR x<>1). The WHERE clause filters at most NULL rows.
Q-PRED-REDUNDANT🟢 lowRedundant predicate: condition is already implied by another predicate (e.g., WHERE x>5 AND x>3). The weaker predicate has no effect.
Q-AGG-MANYDIM🟡 mediumGROUP BY with many columns (>5) may indicate design issues or produce sparse results.
Q-SUBQ-SCALAR🟡 medium|
Q-AGG-NOFILT🟢 lowAggregate query without effective WHERE filter. Consider adding filters to avoid processing entire tables.
Q-SUBQ-CORR-SEL🟠 highCorrelated scalar subquery (N+1 query pattern). Consider rewriting as JOIN for better performance.
Q-SUBQ-CORR-WHERE🟡 mediumCorrelated subquery in WHERE/IN clause. May cause performance issues on large datasets. Consider rewriting with EXISTS or JOIN.
Q-AGG-NONDET🟡 mediumNon-deterministic expression in GROUP BY context. Results may vary between executions with same data.
Q-WIN-NONDET🟠 highNon-deterministic expression in window function. Results may vary between executions with same data.
Q-NONDET🟡 mediumQuery contains non-deterministic elements. Results may vary between executions.
Q-WIN-MULTIPART🟡 mediumMultiple window functions with different PARTITION BY clauses. Query will re-partition data multiple times, causing additional shuffles.
Q-TBL-UNBOUNDED-CENH🟠 highUnbounded query on large table — WHERE clause is absent or tautological. Consider adding filters to reduce data scanned. [Catalog-enhanced]
Q-TBL-SELSTAR-WIDE-CENH🟡 mediumSELECT * on wide table (50+ columns). Scanning many unnecessary columns increases I/O and network transfer. Consider explicit column selection. [Catalog-enhanced]
Q-AGG-NOFILT-CENH🟡 mediumAggregating a large table (1M+ rows) without effective WHERE filter. Consider adding time/partition filters to reduce scan size. [Catalog-enhanced]
Q-WIN-NOPART-CENH🟠 highWindow function without PARTITION BY operates on entire large table (1M+ rows) in single partition. Add PARTITION BY to reduce memory pressure. [Catalog-enhanced]
Q-WIN-UNBOUNDED-CENH🔴 criticalWindow function with unbounded frame and no PARTITION BY. Extremely expensive on large datasets - entire table processed as one partition. [Catalog-enhanced]
Q-WIN-HICARD-CENH🟠 highWindow function partitioned on high-cardinality column. May cause performance issues. [Catalog-enhanced]
Q-WIN-USAGE🟢 lowWindow function usage detected. Verify PARTITION BY and ORDER BY clauses.
Q-PROP-CONTRA🔴 criticalCross-scope contradiction: consumer predicate contradicts upstream CTE/subquery constraint. Query will always return zero rows from the upstream source.
Q-SUBQ-REPEAT🟡 mediumRepeated subquery pattern detected. Consider using CTEs or temporary tables for better readability and potential performance improvement.
Q-WIN-FRAME🟢 lowCustom window frame specification detected. Verify boundaries.
Q-JOIN-TYPEMIS-CENH🟡 mediumJOIN on columns with mismatched data types. This causes implicit type conversion and may prevent index usage, resulting in slower queries. [Catalog-enhanced]
Q-JOIN-NULL-CENH🟠 highJOIN on nullable column silently excludes NULL values. NULL values in this column will not match, potentially losing data. Consider LEFT JOIN or add IS NOT NULL filter. [Catalog-enhanced]
Q-FLOW-DROP-REF🔴 criticalStatement references a table or view that was dropped by a prior statement in this script. This statement will fail at runtime.
Q-FLOW-RENAME-REF🟠 highStatement references a table by its old name after it was renamed by a prior statement in this script. Use the new name or reorder the statements.
Q-FLOW-COL-DROP🔴 criticalStatement references a column that was dropped by a prior ALTER TABLE statement in this script. This statement will fail at runtime.
Q-FLOW-TAINT⚪ infoOutput column materializes the value of a classified source (catalog tag). When materialized by a privileged role (e.g. dbt service account), source masking policies do not protect the destination table. Ensure the destination has its own masking policy or access controls.
Q-NULL-COUNT-CENH🟠 highCOUNT({column}) on confirmed nullable column excludes NULL values. This column is nullable per catalog metadata. If counting all rows including NULLs, use COUNT(*) instead. [Catalog-enhanced]
Q-VIEW-REF-CENH🟡 mediumQuery references VIEW(s). Views are recomputed on every execution (not materialized). [Catalog-enhanced]
Q-AGG-HICARD🟡 mediumGROUP BY combines two or more high-cardinality columns (IDs, emails, hashes). Each near-unique key multiplies the group count toward one group per row, so the aggregation stops summarizing while still paying full grouping cost. Group by the one entity key you need, or pre-aggregate per key.
Q-NULL-NEQ🟡 mediumNULL-logic warning: <> or != operator on column(s) [{witness.column.name.raw}] will not match NULL values. If NULLs are valid data, use 'OR column IS NULL' or IS DISTINCT FROM.
Q-JOIN-FKVIOL-CENH🔴 criticalJOIN doesn't follow defined foreign key relationship. The FK constraint specifies different columns than those used in the JOIN, which is likely a logic error. [Catalog-enhanced]
Q-JOIN-LEFT-FILT🔴 criticalLEFT JOIN nullable side filtered in WHERE clause. This effectively converts the LEFT JOIN to an INNER JOIN, likely a bug.
Q-JOIN-TEMPORAL-CENH🟡 mediumTemporal join without explicit date bounds. This may cause full table scans or incorrect results across time periods. [Catalog-enhanced]
Q-MULTI-TEMPORAL-CENH🟡 mediumTables with temporal columns (DATE/TIMESTAMP) are joined without date filter in WHERE or JOIN ON. This can cause unbounded historical joins with poor performance. [Catalog-enhanced]
Q-JOIN-DISTINCT-MASK🟡 mediumDISTINCT may be masking a join fan-out. If the join produces duplicate rows, DISTINCT hides rather than fixes the issue. Consider verifying join cardinality or using EXISTS.
Q-JOIN-DISTINCT-MASK-CENH🟠 highDISTINCT confirmed to mask a join fan-out. Catalog shows join keys lack unique constraints, meaning the join will produce duplicates. DISTINCT hides this bug rather than fixing it. [Catalog-enhanced]
Q-JOIN-FANOUT-CENH🟠 highJoin produces row multiplication (1:N relationship). Aggregates or counts may be inflated. Consider using a subquery or window function. [Catalog-enhanced]
Q-AGG-EXPLODE-CENH🟡 mediumMultiple joins with aggregation but no effective WHERE filter. This can cause exponential row explosion and incorrect aggregates. [Catalog-enhanced]

DML Signals (DML-xxx)

Rule IDRiskDescription
DML-WRITE-UNBOUNDED🔴 criticalUnbounded write operation detected - the statement has no WHERE clause or its WHERE clause matches every row. This affects ALL rows in the target table(s).
DML-MERGE-DELETE🟡 mediumMERGE branch deletes every matched row: WHEN MATCHED THEN DELETE carries no additional condition, so each target row satisfying the ON clause is deleted. A MERGE reads as an upsert in review — verify the deletion is intended, or guard the branch (WHEN MATCHED AND <condition> THEN DELETE).
DML-MERGE-DELETE-BY-SOURCE🟡 mediumMERGE branch deletes every target row absent from the source: WHEN NOT MATCHED BY SOURCE THEN DELETE carries no additional condition. If the source is empty, over-filtered, or wrong, the target table is emptied. Verify the source population, or guard the branch (WHEN NOT MATCHED BY SOURCE AND <condition> THEN DELETE).
DML-WRITE-XSCHEMA🟡 mediumCross-schema write operation detected. Verify schema permissions and change control procedures.
DML-WRITE-MULTITBL🟢 lowWrite operation affects multiple tables. Verify transaction boundaries and rollback plan.

Credential Exposure (CRED-xxx)

Rule IDRiskDescription
CRED-AWS-LEAK🔴 criticalHardcoded AWS credentials detected (access key ID, secret access key, or session token). Never commit credentials to source code. Use secure parameter passing, secrets managers, or storage integrations instead.
CRED-PWD-LEAK🔴 criticalHardcoded password detected in SQL. Use secure parameter passing (e.g., :password_param) or secrets management instead of literal passwords.
CRED-APIKEY-LEAK🔴 criticalHardcoded API key, token, or cloud secret detected (API key, access token, OAuth client secret, or cloud-storage secret key). Store secrets in a secrets manager or storage integration, not in SQL code.
CRED-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected (user:password@host). Use secure credential storage instead of embedding credentials in URLs.
CRED-DUMMY-VALUE⚪ infoCredential property is set to a placeholder-style dummy value (empty or REPLACE_ME-style) — not a live secret. Replace it with secure parameter passing or a managed secret before this runs.
CRED-INLINE-AUTH🟢 lowAuthentication is embedded inline via CREDENTIALS=(...). Even with injected values, inline auth bypasses the platform's managed mechanism — prefer a storage integration (Snowflake) or an attached IAM role (Redshift) so credentials never travel through SQL text.

Table Operations (TBL-xxx)

Rule IDRiskDescription
TBL-DROP🔴 criticalDROP TABLE detected. Table and all data will be permanently deleted.
TBL-TRUNCATE🔴 criticalTRUNCATE TABLE detected. All rows will be permanently deleted.
TBL-REPLACE🟠 highCREATE OR REPLACE TABLE detected. Existing table definition (and potentially data semantics) is replaced.
TBL-RENAME🟡 mediumALTER TABLE RENAME detected. Downstream references (queries, views, jobs) may break if not updated.
TBL-COL-ADD🟢 lowALTER TABLE ADD COLUMN detected. Schema expanded; verify downstream contracts and ingestion mappings.
TBL-COL-DROP🟠 highALTER TABLE DROP COLUMN detected. Column data and dependent objects may be lost or broken.
TBL-MASK-ADD🟢 lowColumn masking or projection policy added. Positive governance signal.
TBL-MASK-RMV🔴 criticalMasking or Projection Policy removed from column. This exposes PII or sensitive data.
TBL-RAP-ADD🟢 lowRow Access Policy added to table. Positive governance signal.
TBL-RAP-RMV🟠 highRow Access Policy removed from table. This may expose sensitive data to unauthorized users.
TBL-RAP-RMV-ALL🔴 criticalAll Row Access Policies dropped from table. All row-level access controls removed from this table.
TBL-AGGPOL-RMV🟡 mediumAggregation or Join Policy removed from table. This may allow unrestricted data aggregation or joins.
TBL-JOINPOL-SET🟡 mediumJoin policy attached to table via SET JOIN POLICY. The table's join behavior is now governed by the named policy — confirm the policy enforces the intended restriction.
TBL-AGGPOL-SET🟡 mediumAggregation policy attached to table via SET AGGREGATION POLICY. The table's aggregation/privacy constraints are now governed by the named policy — confirm it enforces the intended minimum group size.
TBL-DMF-ADD🟢 lowData metric function attached to table via ADD DATA METRIC FUNCTION. Data-quality monitoring is now in place on the named columns.
TBL-DMF-DROP🟡 mediumData metric function detached from table via DROP DATA METRIC FUNCTION. The data-quality monitor it provided is removed.
TBL-TAG-ADD🟢 lowTag added to object. Positive governance signal.
TBL-TAG-RMV🟡 mediumTag removed from object. Governance metadata may be incomplete.

View Operations (VIEW-xxx)

Rule IDRiskDescription
VIEW-REPLACE🟡 mediumCREATE OR REPLACE VIEW detected. Existing view definition is replaced and downstream logic may change.
VIEW-CHG🟡 mediumALTER VIEW changes a view definition or attributes. Views control data access patterns; changes affect all queries through the view.
VIEW-DROP🟡 mediumDROP VIEW removes a view. Dependent queries and applications will break. Check for CASCADE to identify cascading object removal.
VIEW-CASCADE-DROP🟠 highDROP VIEW ... CASCADE removes the view AND all dependent objects (other views, rules). Cascading drops can silently remove data access controls.

Schema Operations (SCHEMA-xxx)

Rule IDRiskDescription
SCHEMA-DROP🔴 criticalDROP SCHEMA detected. All objects in schema will be permanently deleted.
SCHEMA-NAME-CHG🟡 mediumSchema renamed. Verify all references to the old name are updated.
SCHEMA-PROPS-CHG🟡 mediumSchema properties modified. Configuration change may affect behavior.
SCHEMA-TAG-ADD🟢 lowSchema tag assigned. Governance metadata updated.
SCHEMA-TAG-RMV🟡 mediumSchema tag removed. Governance metadata may be incomplete. Verify tag removal is intentional.
SCHEMA-CLONE🟡 mediumSchema cloned from existing schema. Verify access controls are appropriate for the clone.

Database Operations (DB-xxx)

Rule IDRiskDescription
DB-CLONE🟡 mediumDatabase cloned from existing database. Verify access controls are appropriate for the clone.
DB-NAME-CHG🟡 mediumDatabase renamed. Verify all references to the old name are updated.
DB-PROPS-CHG🟡 mediumDatabase properties modified. Configuration change may affect behavior.
DB-TAG-ADD🟢 lowDatabase tag assigned. Governance metadata updated.
DB-TAG-RMV🟡 mediumDatabase tag removed. Governance metadata may be incomplete. Verify tag removal is intentional.
DB-DROP🔴 criticalDROP DATABASE detected. All schemas, tables, and data within the database will be permanently deleted.

Masking Policies (MASK-xxx)

Rule IDRiskDescription
MASK-NEW🟢 lowMasking Policy created. Positive governance signal.
MASK-ALLOW-ALL🔴 criticalMasking Policy body passes through the original value without masking. Policy is effectively a no-op and sensitive data may be exposed.
MASK-BODY-CHG🔴 criticalMasking Policy logic changed. Data protection logic modified.
MASK-NAME-CHG🟠 highMasking Policy renamed. Dependent columns may be affected.
MASK-TAG-RMV🟡 mediumTag removed from Masking Policy. Governance metadata may be incomplete.
MASK-TAG-ADD🟢 lowTag added to Masking Policy. Positive governance signal.
MASK-COMMENT-ADD🟢 lowComment added to Masking Policy. Positive documentation signal.
MASK-COMMENT-RMV🟢 lowComment removed from Masking Policy. Documentation lost.
MASK-DROP🔴 criticalMasking Policy dropped. Column data protection removed. All columns using this policy will be unmasked.

Row Access Policies (RAP-xxx)

Rule IDRiskDescription
RAP-NEW🟢 lowRow Access Policy created. Ensure proper testing and documentation.
RAP-ALLOW-ALL🔴 criticalRow Access Policy predicate is always true. Policy is effectively a no-op and does not restrict row access. Applies to Snowflake, BigQuery, and PostgreSQL RLS.
RAP-BODY-CHG🔴 criticalRow Access Policy logic changed. Access control logic modified.
RAP-NAME-CHG🟠 highRow Access Policy renamed. Dependent objects may be affected.
RAP-TAG-RMV🟡 mediumTag removed from Row Access Policy. Governance metadata may be incomplete.
RAP-TAG-ADD🟢 lowTag added to Row Access Policy. Positive governance signal.
RAP-COMMENT-ADD🟢 lowComment added to Row Access Policy. Positive documentation signal.
RAP-COMMENT-RMV🟢 lowComment removed from Row Access Policy. Documentation lost.
RAP-DROP🔴 criticalRow Access Policy dropped. Row-level access controls removed. All tables using this policy will no longer filter rows.

Grant & Access (GRT-xxx)

Rule IDRiskDescription
GRT-WITH-OPT🟠 highAvoid WITH GRANT OPTION. This allows the grantee to re-grant privileges and can lead to privilege escalation.
GRT-ALL-PRIV🟠 highAvoid GRANT ALL PRIVILEGES. Use specific privilege grants to follow the principle of least privilege.
GRT-TO-PUBLIC🔴 criticalAvoid granting privileges to PUBLIC. The PUBLIC role includes all users in the account, which may expose data unintentionally.
GRT-TO-SHARE🔴 criticalData sharing boundary crossed: granting to SHARE exposes data outside the account. Verify data classification and approval.
GRT-OWNER-XFER🟠 highOwnership transfer detected. Verify approval and ensure proper access controls remain in place.
GRT-SYSROLE-EXP🔴 criticalGrant involves privileged system role (ACCOUNTADMIN, SECURITYADMIN, SYSADMIN, USERADMIN, PUBLIC). This has account-wide security implications.
GRT-ACCESS-EXP-HI🟠 highRole hierarchy change significantly expands effective access. Child role inherits 50+ privileges or affects 10+ users.
GRT-ACCESS-EXP🟡 mediumRole hierarchy change detected. Child role inherits privileges from parent role, affecting downstream roles and users.
GRT-BROAD-PRIV-HI🟠 highObject privilege grant affects 20+ users via role inheritance. Review if this access scope is intentional.
GRT-BROAD-PRIV🟡 mediumBroad privilege grant detected. Object privilege affects multiple roles and users via role inheritance.

Functions & Procedures (UDF/PROC/FUNC-xxx)

Rule IDRiskDescription
UDF-NEW🟢 lowUser-defined function created. Verify return type and usage patterns.
UDF-DYNSQL🟠 highUser-defined function executes dynamic SQL with potential injection vector. SQL injection risk if inputs are not validated. Consider parameterized queries (e.g. USING clause).
UDF-SECURE-RMV🟠 highSECURE flag removed from function. Function body is now visible to users with USAGE privilege.
UDF-EXTACC-CFG🟡 mediumFunction configured with external access integrations or secrets. Review access permissions.
FUNC-DROP🟡 mediumDROP FUNCTION detected. Function definition removed. Verify no dependencies.
PROC-NEW🟢 lowStored procedure created. Verify business logic and access controls.
PROC-DYNSQL🟠 highStored procedure executes dynamic SQL with potential injection vector. SQL injection risk if inputs are not validated. Consider parameterized queries (e.g. USING clause / sp_executesql parameters).
PROC-DROP🟡 mediumDROP PROCEDURE detected. Procedure definition removed. Verify no dependencies.
PROC-SECURE-RMV🟠 highSECURE flag removed from procedure. Procedure body is now visible to users with USAGE privilege.
PROC-EXECAS-OWNER🟡 mediumProcedure set to EXECUTE AS OWNER. RISK: If owner has elevated privileges (e.g., deploy role), this grants all callers elevated access. Consider EXECUTE AS CALLER for better privilege isolation.
PROC-EXECAS-CALLER🟢 lowProcedure set to EXECUTE AS CALLER. Runs with invoker's privileges. Safer than OWNER if procedure owner has elevated rights (e.g., deploy role). Context-dependent security.
PROC-EXECAS-RESTRICT🟠 highProcedure set to EXECUTE AS RESTRICTED CALLER. This is a significant compromise between security models - review carefully.
PROC-EXTACC-CFG🟡 mediumProcedure configured with external access integrations or secrets. Review access permissions.

Dynamic SQL (DYNSQL-xxx)

Rule IDRiskDescription
DYNSQL🟠 highDynamic SQL execution detected. SQL injection risk if input parameters are not validated. Consider parameterized queries (USING clause / sp_executesql parameters).
DYNSQL-CONCAT🔴 criticalDynamic SQL argument is built via string concatenation or FORMAT(...) interpolation. SQL injection risk — switch to a parameterized query (USING clause / sp_executesql parameter binding).
DYNSQL-NO-PARAM🟡 mediumDynamic SQL executed without parameter binding when the surface supports it (Snowflake USING, sp_executesql @params, EXECUTE … USING). Bind runtime values rather than interpolating.
DYNSQL-PARAM-CLEAN⚪ infoDynamic SQL recognized as injection-clean: every interpolated value is quoted into an identifier or literal slot it cannot break out of. Informational — verify no untrusted value reaches an unquoted slot.
DYNSQL-QUOTE-MISMATCH🔴 criticalDynamic SQL applies identifier quoting to a value placed inside a string literal. Identifier quoting (QUOTENAME / quote_ident / %I) delimits identifiers and does not escape the string-literal quote, so the value can still break out of the literal — use literal quoting (quote_literal / QUOTE / %L) or a bound parameter.
DYNSQL-LITERAL-QUOTER-IDENT🟡 mediumDynamic SQL applies literal/string quoting to a value placed in an identifier position (a table or column name). Literal quoting (quote_literal / QUOTE / %L) produces a quoted string, not an identifier, so the assembled statement is malformed or refers to the wrong object — use identifier quoting (quote_ident / QUOTENAME / %I) or validate the name against an allow-list.
DYNSQL-CROSS-SERVER🔴 criticalCross-server dynamic SQL execution detected. The remote server's auth context is exercised — validate the connection string and SQL construction.

External Tables (EXTTBL-xxx)

Rule IDRiskDescription
EXTTBL-NEW🟢 lowExternal table created. Federated data source registered for querying.

Diff Signals (DIFF-xxx)

Rule IDRiskDescription
DIFF-WRITE-WHERE-RMV🔴 criticalWrite statement became unbounded after WHERE clause was removed. May affect entire table.
DIFF-LIMIT-RMV-MULTI🔴 criticalLIMIT removed from multi-table query. Potential cartesian explosion.
DIFF-JOIN-CROSS-ADD🔴 criticalJOIN changed from {witness.baseline_kind} to CROSS. Cartesian product risk.
DIFF-SAMPLE-ADD🔴 criticalSAMPLE/TABLESAMPLE added. Query now operates on SUBSET of data.
DIFF-LIMIT-RMV🟠 highLIMIT removed. Query is now unbounded.
DIFF-WHERE-RMV🟠 highWHERE clause removed. Query is now unbounded.
DIFF-JOIN-RMV🟠 highJOIN removed. Data relationship lost.
DIFF-DISTINCT-RMV🟠 highDISTINCT removed. Query may now return duplicate rows.
DIFF-JOIN-NARROW🟠 highJOIN changed from {witness.baseline_kind} to {witness.head_kind}. May silently drop rows.
DIFF-HAVING-RMV🟠 highHAVING clause removed. Aggregate filtering lost.
DIFF-GROUPBY-COL-RMV🟠 highGROUP BY column removed. May cause aggregate explosion or changed grouping.
DIFF-QUALIFY-RMV-MULTI🟠 highQUALIFY clause removed from multi-table query with window functions. Window function filtering lost.
DIFF-AGG-FUNC-CHG🟠 highAggregate function changed from {witness.baseline} to {witness.head}. Verify business logic.
DIFF-JOIN-COND-CHG🟠 highJOIN condition changed. Data relationship logic altered.
DIFF-WHERE-COND-CHG🟠 highWHERE clause predicates changed. Query filtering logic altered.
DIFF-WIN-PART-CHG🟠 highWindow function partition changed. Results may differ.
DIFF-UNION-TO-UNIONALL🟠 highUNION changed to UNION ALL. Deduplication lost — may return duplicate rows.
DIFF-STMT-KIND-CHG🟠 highStatement type changed from {witness.baseline} to {witness.head}. Verify intent.
DIFF-PROJ-CHG🟡 mediumOutput projection slot changed from {witness.baseline_kind} to {witness.head_kind}. Verify output semantics.
DIFF-WIN-FRAME-CHG🟠 highWindow frame changed. Running totals, rankings, or cumulative calculations affected.
DIFF-WIN-PART-RMV🟠 highPARTITION BY removed from window function. Function now operates over entire result set instead of per-group.
DIFF-AGG-DISTINCT-RMV🟠 highDISTINCT removed from aggregate function. May now count/sum duplicate values.
DIFF-SUBQ-SCOPE-CHG🟠 highSubquery scope type changed (e.g., EXISTS→NOT EXISTS). Query logic inverted.
DIFF-JOIN-TYPE-CHG🟡 mediumJOIN type changed from {witness.baseline_kind} to {witness.head_kind}. Verify result-set behavior.
DIFF-QUALIFY-RMV🟡 mediumQUALIFY clause removed. Window function filtering lost.
DIFF-TBL-RMV🟡 mediumTable removed from query. Data relationship changed.
DIFF-CTE-RMV🟡 mediumCTE (Common Table Expression) removed. Query structure simplified.
DIFF-XSCHEMA-ADD🟡 mediumQuery now accesses tables across different schemas.
DIFF-LIMIT-INCR🟡 mediumLIMIT increased. More data may be returned.
DIFF-SETOP-CHG🟡 mediumSET operation changed from {witness.baseline} to {witness.head}. Query logic altered.
DIFF-WIN-RMV🟡 mediumWindow function {witness.function} removed from query. Analytic computation lost.
DIFF-AGG-DISTINCT-ADD🟡 mediumDISTINCT added to aggregate function. May reduce result values.
DIFF-AGG-ARG-CHG🟡 mediumAggregate function input changed. Verify correct column.
DIFF-GROUPBY-COL-ADD🟡 mediumGROUP BY column added. Aggregation granularity changed.
DIFF-AGG-RMV🟡 mediumAggregate function removed from query. Calculation lost.
DIFF-HAVING-CHG🟡 mediumHAVING clause filter logic changed. Aggregate filtering behavior affected.
DIFF-SETOP-ADD🟡 mediumSET operation (UNION/INTERSECT/EXCEPT) added. Query logic extended.
DIFF-SETOP-RMV🟡 mediumSET operation removed. Query logic simplified.
DIFF-SUBQ-PRED-CHG🟡 mediumPredicate changed within a subquery. Subquery filtering behavior affected.
DIFF-COL-RMV🟢 lowColumn removed from output. Downstream consumers may break.
DIFF-ORDERBY-CHG🟢 lowORDER BY clause changed. Result ordering affected.
DIFF-LIMIT-DECR🟢 lowLIMIT decreased. Query is more restrictive.
DIFF-WHERE-ADD🟢 lowWHERE clause added. Query is now bounded.
DIFF-LIMIT-ADD🟢 lowLIMIT added. Query is now bounded.
DIFF-DISTINCT-ADD🟢 lowDISTINCT added. Duplicates will be removed.
DIFF-QUALIFY-ADD🟢 lowQUALIFY clause added for window function filtering.
DIFF-HAVING-ADD🟢 lowHAVING clause added for aggregate filtering.
DIFF-WRITE-WHERE-ADD🟢 lowWrite statement became bounded with WHERE clause.
DIFF-TBL-ADD🟢 lowNew table added to query.
DIFF-JOIN-ADD🟢 lowNew JOIN added to query.
DIFF-COL-ADD🟢 lowNew column added to output.
DIFF-CTE-ADD🟢 lowCTE (Common Table Expression) added. Query structure enhanced.
DIFF-WIN-ADD🟢 lowWindow function {witness.function} added to query. Adds ranking, row numbering, or analytic computation.
DIFF-AGG-ARG-REFACTOR🟢 lowAggregate function input refactored. Likely a column extraction.
DIFF-AGG-ARG-COL-SUBST🟡 mediumColumn reference inside aggregate input was substituted. Verify the metric still measures the intended attribute.
DIFF-AGG-ARG-CONST-DRIFT🟢 lowHardcoded literal inside aggregate input changed. Verify the constant change is intentional (threshold, default, tax rate).
DIFF-AGG-ARG-OP-FLIP🟠 highBinary operator inside aggregate input changed (e.g. + to -). Output semantics altered.
DIFF-AGG-ARG-UNARY-FLIP🟠 highUnary operator inside aggregate input changed (e.g. IS NULL to IS NOT NULL). Predicate or sign inverted.
DIFF-AGG-ARG-FN-NAME-CHG🟡 mediumFunction called inside aggregate input was replaced. Verify semantic equivalence across dialects.
DIFF-AGG-ARG-FN-ARITY-CHG🟢 lowFunction arity inside aggregate input changed. Fallback chain depth or input set shifted.
DIFF-AGG-ARG-CASE-BRANCH-CHG🟡 mediumCASE branch count inside aggregate input changed. Aggregated output rules shifted.
DIFF-AGG-ARG-CASE-ELSE-ADDED🟡 mediumCASE inside aggregate input gained an ELSE clause. NULL handling now explicit; output for unmatched rows changed.
DIFF-AGG-ARG-CASE-ELSE-RMV🟡 mediumCASE inside aggregate input lost its ELSE clause. Unmatched rows now produce NULL, changing aggregate output for sparse data.
DIFF-AGG-ARG-CAST-TYPE-CHG🟡 mediumCast target type inside aggregate input changed. Precision, truncation, or representation may shift.
DIFF-AGG-ARG-SHAPE-CHG🟡 mediumExpression wrapping shape inside aggregate input changed (e.g. bare column wrapped in COALESCE/function). NULL or coercion semantics altered.
DIFF-AGG-ARG-SUBQ-CHG🟠 highScalar subquery inside aggregate input now reads a different table set. Data dependency shifted.
DIFF-AGG-ARG-FIELD-PATH-CHG🟡 mediumSemi-structured field access path inside aggregate input changed. Verify the new JSON/variant path resolves to the intended attribute.
DIFF-AGG-ADD🟢 lowNew aggregate function added to query.
DIFF-SAMPLE-RMV🟢 lowSAMPLE/TABLESAMPLE removed. Query now operates on full data.
DIFF-NULL-EXPANSION🟠 highOutput column became nullable across the change. Downstream NOT NULL consumers may break silently.
DIFF-LINEAGE-LOSS🟡 mediumOutput column lost upstream source columns. Data provenance shrunk.
DIFF-TAINT-PROPAGATION🟠 highOutput column gained sensitivity tags. Possible PII leak via new join path or new projection.
DIFF-CONSTRAINT-RELAX🟡 mediumOutput column's structural constraints were relaxed. Downstream consumers relying on the constraint may break.

Snowflake (SNW-xxx)

Rule IDRiskDescription
SNW-GRT-PRIV-ROLE🔴 criticalPrivilege escalation detected: granting privileged system role. This gives full administrative control and should require explicit approval.
SNW-STG-CRED-CHG🟠 highStorage credentials changed on stage. Verify authorization and audit trail.
SNW-STG-ENC-OFF🔴 criticalEncryption disabled on stage. This exposes data at rest to potential breaches.
SNW-STG-ENC-ON🟢 lowEncryption enabled on stage. Positive security signal.
SNW-STG-INTG-CHG🟡 mediumStorage integration changed on stage. Verify access controls.
SNW-STG-INTG-SET🟢 lowStorage integration set on stage. External storage access configured.
SNW-STG-TAG-SET🟢 lowTag set on stage. Positive governance signal for metadata tracking.
SNW-STG-TAG-RMV🟡 mediumTag removed from stage. Verify governance metadata tracking is maintained.
SNW-STG-DROP🟡 mediumDROP STAGE detected. Stage and any staged files will be removed.
SNW-EXPORT-UNBOUNDED🟠 highCOPY INTO exports data to external location without filtering. Full table contents may be exposed.
SNW-EXPORT-CLASSIFIED🟠 highCOPY INTO <location> unloads a classified column out of the warehouse with its value exposed (not masked or aggregated). Classified data crossing the egress boundary should be masked, tokenized, or access-restricted at the unload point. The classification can originate in another script (cross-script data flow).
SNW-COPY-ONERROR-LAX🟡 mediumCOPY INTO <table> with ON_ERROR = CONTINUE or SKIP_FILE silently skips rows or files that fail to load. Records can be dropped without raising an error — confirm partial loads are acceptable for the target table.
SNW-COPY-PURGE🟡 mediumCOPY INTO <table> with PURGE = TRUE deletes the source files from the stage after a successful load. The originals are then unrecoverable — verify the data landed in the target table before purging.
SNW-UNKNOWN🟠 highUnknown syntax detected. Cannot verify compliance for this statement. Review against latest Snowflake documentation.
SNW-PWDPOL-NEW🟡 mediumPassword Policy created. Positive security signal - password controls in place.
SNW-PWDPOL-MINLEN-CRIT🔴 criticalPassword Policy created with CRITICAL weak minimum length (<8 characters). This violates basic security standards.
SNW-PWDPOL-MINLEN-WEAK🟠 highPassword Policy created with weak minimum length (8-11 characters). CIS/CISA recommend ≥12 characters (NIST SP 800-63B requires ≥8).
SNW-PWDPOL-MINLEN-CFG🟢 lowPassword Policy minimum length configured. Positive governance signal.
SNW-PWDPOL-MAXLEN-LOW🟡 mediumPassword Policy has restrictive maximum length. Users cannot create long, complex passwords.
SNW-PWDPOL-COMPLEX-WEAK🟠 highPassword Policy created with weak complexity requirements (<2 character classes). Passwords may be easily guessable.
SNW-PWDPOL-COMPLEX-CFG🟢 lowPassword Policy complexity requirements configured. Positive governance signal.
SNW-PWDPOL-NOEXPIRY🔴 criticalPassword Policy created with NO expiration (PASSWORD_MAX_AGE_DAYS = 0). Passwords never expire.
SNW-PWDPOL-EXPIRY-LONG🟠 highPassword Policy created with long expiration (>180 days). Consider shorter expiration period.
SNW-PWDPOL-EXPIRY-STALE🟡 mediumPassword Policy has long expiration period (>=90 days). Passwords remain valid for extended periods.
SNW-PWDPOL-EXPIRY-FAIR🟢 lowPassword Policy has moderate expiration period (30-89 days). Consider tighter expiration for sensitive environments.
SNW-PWDPOL-EXPIRY-CFG🟢 lowPassword Policy expiration configured. Passwords will expire per policy.
SNW-PWDPOL-RETRIES-HIGH🔴 criticalPassword Policy created with high max retries (>10). Account brute-force risk.
SNW-PWDPOL-RETRIES-CHG🟠 highPassword Policy created with moderate max retries (6-10). Consider limiting to 5 or fewer.
SNW-PWDPOL-LOCKOUT-SHORT🟠 highPassword Policy created with short lockout time (<5 minutes). Account brute-force window too small.
SNW-PWDPOL-LOCKOUT-WEAK🟡 mediumPassword Policy has short lockout time (<5 minutes). Brute-force attacks have reduced penalty window.
SNW-PWDPOL-LOCKOUT-CFG🟢 lowPassword Policy lockout configured. Positive governance signal — brute-force protection active.
SNW-PWDPOL-NOHIST🟠 highPassword Policy created with NO history (PASSWORD_HISTORY = 0). Users can reuse passwords immediately.
SNW-PWDPOL-HIST-CFG🟢 lowPassword Policy history configured. Positive governance signal — password reuse prevented.
SNW-PWDPOL-MINLEN-CRITWEAK🔴 criticalPassword minimum length SET to CRITICAL weak value (<8). This violates basic security standards.
SNW-PWDPOL-MINLEN-WEAKEN🟠 highPassword minimum length weakened (8-11 characters). CIS/CISA recommend ≥12 characters (NIST SP 800-63B requires ≥8).
SNW-PWDPOL-EXPIRY-OFF🔴 criticalPassword expiration DISABLED (PASSWORD_MAX_AGE_DAYS = 0). Passwords never expire.
SNW-PWDPOL-EXPIRY-LONGSET🟠 highPassword expiration SET to long duration (>180 days). Consider shorter period.
SNW-PWDPOL-RETRIES-INCR🔴 criticalPassword max retries INCREASED (>10). Account brute-force risk significantly increased.
SNW-PWDPOL-LOCKOUT-CUT🟠 highPassword lockout time SHORTENED (<5 minutes). Brute-force attack window reduced too much.
SNW-PWDPOL-HIST-OFF🟠 highPassword history DISABLED (PASSWORD_HISTORY = 0). Users can reuse passwords immediately.
SNW-PWDPOL-MINLEN-UNSET🔴 criticalPassword minimum length UNSET. Reverts to default (8 characters), weakening security.
SNW-PWDPOL-EXPIRY-UNSET🔴 criticalPassword expiration UNSET. Reverts to default, may remove expiration entirely.
SNW-PWDPOL-HISTORY-UNSET🟠 highPassword history UNSET. Reverts to default (0), users can reuse passwords immediately.
SNW-PWDPOL-RETRIES-UNSET🔴 criticalPassword max retries UNSET. Reverts to default, may allow unlimited login attempts enabling brute-force attacks.
SNW-PWDPOL-LOCKOUT-UNSET🔴 criticalPassword lockout time UNSET. Reverts to default, may remove account lockout protection enabling brute-force attacks.
SNW-PWDPOL-NAME-CHG🟠 highPassword Policy renamed. This may break user/role assignments referencing this policy.
SNW-PWDPOL-TAG-ADD🟢 lowPassword Policy tag set. Positive governance signal — metadata tag added.
SNW-PWDPOL-TAG-RMV🟡 mediumPassword Policy tag removed. Governance metadata lost. Verify this is intentional.
SNW-PWDPOL-COMMENT-RMV🟢 lowComment removed from Password Policy. Documentation lost.
SNW-PWDPOL-DROP🔴 criticalPassword Policy dropped. Password strength controls removed. Verify this doesn't weaken authentication security.
SNW-SESSPOL-NEW🟢 lowSession Policy created. Positive governance signal — session timeout controls configured.
SNW-SESSPOL-IDLE-LONG🟠 highSession Policy created with long idle timeout (>24 hours). Consider shorter timeout for better security.
SNW-SESSPOL-UIIDLE-LONG🟠 highSession Policy created with long UI idle timeout (>24 hours). Consider shorter timeout for better security.
SNW-SESSPOL-IDLE-LONGSET🟠 highSession idle timeout SET to long duration (>24 hours). Consider shorter timeout for better security.
SNW-SESSPOL-UIIDLE-LONGSET🟠 highUI idle timeout SET to long duration (>24 hours). Consider shorter timeout for better security.
SNW-SESSPOL-IDLE-CHG🟡 mediumSession idle timeout modified. Review new timeout value.
SNW-SESSPOL-IDLE-UNSET🔴 criticalSession idle timeout UNSET. Sessions can remain active indefinitely. This weakens security posture significantly.
SNW-SESSPOL-UIIDLE-UNSET🔴 criticalUI idle timeout UNSET. UI sessions can remain active indefinitely. Verify this doesn't create unattended access risk.
SNW-SESSPOL-NAME-CHG🟡 mediumSession Policy renamed. Verify all roles/users referencing this policy are updated.
SNW-SESSPOL-TAG-ADD🟢 lowSession Policy tag set. Positive governance signal — metadata tag added.
SNW-SESSPOL-TAG-RMV🟡 mediumSession Policy tag removed. Governance metadata lost. Verify this is intentional.
SNW-SESSPOL-COMMENT-ADD🟢 lowComment added to Session Policy. Positive documentation signal.
SNW-SESSPOL-COMMENT-RMV🟢 lowComment removed from Session Policy. Documentation lost.
SNW-SESSPOL-DROP🔴 criticalSession Policy dropped. Session governance controls removed. All roles/users referencing this policy lose session management.
SNW-NETPOL-NEW🟢 lowNetwork Policy created. The policy takes effect only when attached to the account, a user, or a security integration (ALTER ... SET NETWORK_POLICY); review its allowed and blocked IP lists before attachment.
SNW-NETPOL-IPALLOW-CFG🟢 lowNetwork Policy ALLOWED_IP_LIST configured. IP allowlist established.
SNW-NETPOL-IPALLOW-ANY🟠 highNetwork Policy ALLOWED_IP_LIST permits all IPv4 addresses (0.0.0.0/0). The policy imposes no source-IP restriction, so the account is reachable from anywhere on the internet — equivalent to having no network policy. Replace the open range with the specific corporate/VPN CIDR blocks that should reach the account.
SNW-NETPOL-IPBLOCK-CFG🟢 lowNetwork Policy BLOCKED_IP_LIST configured. IP blocklist established.
SNW-NETPOL-RULELIST-CFG🟡 mediumNetwork Policy ALLOWED_NETWORK_RULE_LIST configured. Network rules referenced.
SNW-NETPOL-SET🔴 criticalNetwork Policy SET operation. This replaces the entire IP/rule list. Verify authorization and review new configuration.
SNW-NETPOL-ADD🟠 highNetwork Policy ADD operation. Network rules or IPs added.
SNW-NETPOL-RMV🔴 criticalNetwork Policy REMOVE operation. Network restrictions removed.
SNW-NETPOL-NAME-CHG🟠 highNetwork Policy renamed. Dependent objects may be affected.
SNW-NETPOL-TAG-ADD🟢 lowTag added to Network Policy. Positive governance signal.
SNW-NETPOL-TAG-RMV🟡 mediumTag removed from Network Policy. Governance metadata may be incomplete.
SNW-NETPOL-COMMENT-RMV🟢 lowComment removed from Network Policy. Documentation cleared.
SNW-NETPOL-DROP🔴 criticalNetwork Policy dropped. Network access controls removed.
SNW-AUTHPOL-NEW🟠 highAuthentication Policy created. New authentication controls established.
SNW-AUTHPOL-MFA-OFF🔴 criticalAuthentication Policy created without MFA requirement. Multi-factor authentication not enforced, accounts vulnerable to credential compromise.
SNW-AUTHPOL-CHG🟠 highAuthentication Policy modified. Authentication controls changed. Review new configuration.
SNW-AUTHPOL-METHODS-CHG🔴 criticalAuthentication methods changed. Allowed authentication methods modified. Verify this is authorized.
SNW-AUTHPOL-MFA-CHG🔴 criticalMFA requirement changed. Multi-factor authentication policy modified. Verify enforcement still meets compliance requirements.
SNW-AUTHPOL-CLIENT-CHG🟠 highClient types changed. Allowed client types modified. Verify this is authorized.
SNW-AUTHPOL-SECINTG-CHG🔴 criticalSecurity integrations changed. Authentication providers modified. Verify trust relationships remain intact.
SNW-AUTHPOL-DROP🔴 criticalAuthentication Policy dropped. Authentication controls removed. Account vulnerable to credential compromise.
SNW-AUTHPOL-ON🟢 lowAuthentication policy enabled. Positive security signal.
SNW-AUTHPOL-OFF🔴 criticalAuthentication policy disabled. Identity verification suspended.
SNW-USER-DEFAULT-ROLE-PRIV🟠 highUser assigned a privileged system role as DEFAULT_ROLE (ACCOUNTADMIN, SECURITYADMIN, SYSADMIN, ORGADMIN, or USERADMIN). The default role activates automatically on every login, so all sessions run with account-wide privileges by default. Assign a least-privilege default role and require explicit role activation for administrative work.
SNW-USER-MFA-BYPASS🟠 highUser configured with a multi-factor authentication bypass window (MINS_TO_BYPASS_MFA greater than zero). During the window the user can authenticate without MFA, weakening protection against credential compromise. Set MINS_TO_BYPASS_MFA to 0 unless a time-boxed enrollment exception is actively in use.
SNW-USER-TYPE-LEGACY🟡 mediumUser created with TYPE = LEGACY_SERVICE. Legacy service users permit password and SAML authentication for non-interactive workloads and are deprecated in favor of TYPE = SERVICE with key-pair or OAuth authentication. Migrate legacy service accounts to reduce the password-based attack surface.
SNW-USER-PWD-NO-CHANGE🟡 mediumUser created with a password but MUST_CHANGE_PASSWORD = FALSE. The administrator-set password persists with no forced rotation on first login, leaving a known credential in place. Set MUST_CHANGE_PASSWORD = TRUE so the user establishes a private password.
SNW-AGGPOL-NEW🟠 highAggregation Policy created. This controls minimum group sizes for aggregation queries to prevent small group disclosures. Verify MIN_GROUP_SIZE is adequate for your privacy requirements.
SNW-AGGPOL-NOCONST🔴 criticalAggregation Policy uses NO_AGGREGATION_CONSTRAINT. This removes all aggregation protections, allowing small group queries that may disclose sensitive information.
SNW-AGGPOL-GRPSZ-CRIT🔴 criticalAggregation Policy has dangerously low MIN_GROUP_SIZE (< 3). Groups smaller than 3 can easily lead to re-identification.
SNW-AGGPOL-GRPSZ-LOW🟠 highAggregation Policy has low MIN_GROUP_SIZE (3-4). While better than 1-2, groups of 3-4 still pose re-identification risks.
SNW-AGGPOL-GRPSZ-STRONG🟢 lowAggregation Policy has strong MIN_GROUP_SIZE (≥10). Good privacy protection. This significantly reduces re-identification risk.
SNW-AGGPOL-COND🟡 mediumAggregation Policy uses conditional logic (CASE expressions). Conditional policies can have different protections for different scenarios. Verify all branches have adequate MIN_GROUP_SIZE values.
SNW-AGGPOL-NOCONST-CHG🔴 criticalAggregation Policy body changed to NO_AGGREGATION_CONSTRAINT. Protection removed entirely. This exposes data to unrestricted aggregation queries.
SNW-AGGPOL-CHG🟡 mediumAggregation Policy altered. Policy modified. Review changes to ensure they maintain adequate privacy protections.
SNW-AGGPOL-NAME-CHG🟡 mediumAggregation Policy renamed. Policy name changed. Verify references to this policy are updated in dependent objects and documentation.
SNW-AGGPOL-TAG-ADD🟢 lowAggregation Policy tag set. Metadata tag added to policy. Informational only.
SNW-AGGPOL-TAG-RMV🟡 mediumAggregation Policy tag removed. Governance metadata lost. Verify this is intentional.
SNW-AGGPOL-COMMENT-ADD🟢 lowComment added to Aggregation Policy. Positive documentation signal.
SNW-AGGPOL-COMMENT-RMV🟢 lowComment removed from Aggregation Policy. Documentation lost.
SNW-AGGPOL-DROP🔴 criticalAggregation Policy dropped. Aggregation protections removed. This removes minimum group size constraints, potentially exposing sensitive data through small group aggregations.
SNW-PROJPOL-NEW🟢 lowProjection Policy created. Positive governance signal — projection controls in place.
SNW-PROJPOL-DROP🟠 highProjection Policy dropped. Projection controls removed. Verify dependent objects are updated.
SNW-PROJPOL-CHG🟡 mediumProjection Policy altered. Policy modified. Review changes.
SNW-PROJPOL-NAME-CHG🟡 mediumProjection Policy renamed. Verify references in dependent objects.
SNW-PROJPOL-ALLOWLIST🟡 mediumProjection Policy uses ALLOW => TRUE. Verify allowlist is intentional.
SNW-PROJPOL-ENFORCE-OFF🔴 criticalProjection Policy enforcement DISABLED (ENFORCEMENT => 'NULLIFY'). Constraints not enforced; data exposed.
SNW-PROJPOL-ENFORCE-ON🟢 lowProjection Policy enforcement enabled. Positive security signal.
SNW-PROJPOL-COND🟡 mediumProjection Policy uses conditional logic (CASE expressions). Verify all branches have adequate constraints.
SNW-PROJPOL-TAG-ADD🟢 lowProjection Policy tag set. Positive governance signal — metadata tag added.
SNW-PROJPOL-TAG-RMV🟡 mediumProjection Policy tag removed. Governance metadata lost.
SNW-PROJPOL-COMMENT-ADD🟢 lowComment added to Projection Policy. Positive documentation signal.
SNW-PROJPOL-COMMENT-RMV🟢 lowComment removed from Projection Policy. Documentation lost.
SNW-JOINPOL-NEW🟢 lowJoin policy created. Join controls in place — verify the JOIN_CONSTRAINT body matches the intended restriction.
SNW-JOINPOL-DROP🟠 highJoin policy dropped. Join controls removed; tables it governed no longer restrict their join behavior.
SNW-JOINPOL-CHG🟡 mediumJoin policy altered. Review the change to the join restriction.
SNW-JOINPOL-NAME-CHG🟡 mediumJoin policy renamed. Verify references in dependent objects.
SNW-JOINPOL-PERMISSIVE🟠 highJoin policy permits unrestricted joins (JOIN_REQUIRED => FALSE). Cross/cartesian joins are not blocked on the governed tables.
SNW-JOINPOL-REQUIRED🟢 lowJoin policy requires a join predicate (JOIN_REQUIRED => TRUE). Positive governance signal.
SNW-JOINPOL-COND🟡 mediumJoin policy uses conditional logic (CASE expression). Verify every branch imposes the intended join restriction.
SNW-JOINPOL-TAG-ADD🟢 lowJoin policy tag set. Metadata tag added.
SNW-JOINPOL-TAG-RMV🟡 mediumJoin policy tag removed. Governance metadata lost.
SNW-MASK-EXEMPT🔴 criticalMasking Policy created with EXEMPT_OTHER_POLICIES = TRUE. May bypass other data protection policies.
SNW-API-INTG-NEW🔴 criticalAPI Integration created. New external API access established. Verify endpoint security.
SNW-API-INTG-NOPFX🟡 mediumAPI Integration created or modified WITHOUT prefix restrictions. Unrestricted API access may be granted. Consider setting API_ALLOWED_PREFIXES or API_BLOCKED_PREFIXES.
SNW-API-INTG-ON🟢 lowAPI Integration enabled. Info: Integration is active.
SNW-API-INTG-OFF🟠 highAPI Integration disabled. Integration is no longer active. Verify dependent services are not impacted.
SNW-API-INTG-CREDCHG🟠 highAPI credential changed on API Integration. Authentication credential or cloud IAM reference modified. Audit trail required.
SNW-API-INTG-CREDRMV🟠 highAPI Key UNSET from API Integration. Authentication credential removed. Verify this change is intentional.
SNW-STGINTG-NEW🟠 highStorage Integration created. New external storage access established. Verify cloud IAM trust relationship.
SNW-STGINTG-NEW-OFF🟡 mediumStorage Integration created with ENABLED = FALSE. Integration not active at creation.
SNW-STGINTG-OFF🔴 criticalStorage Integration disabled. External storage access suspended.
SNW-STGINTG-ON🟢 lowStorage Integration enabled. Positive signal — integration active.
SNW-STGINTG-AWS-CHG🔴 criticalStorage Integration AWS role changed. Cloud IAM trust relationship modified. Verify authorization.
SNW-STGINTG-AZURE-CHG🔴 criticalStorage Integration Azure tenant changed. Cloud trust relationship modified. Verify authorization.
SNW-STGINTG-LOC-CHG🟠 highStorage Integration allowed locations changed. Data access scope modified.
SNW-STGINTG-BLOCKLOC-CHG🟠 highStorage Integration blocked locations changed. Data access scope modified.
SNW-STGINTG-TAG-ADD🟢 lowStorage Integration tag set. Positive governance signal — metadata tag added.
SNW-STGINTG-TAG-RMV🟡 mediumStorage Integration tag removed. Governance metadata lost. Verify this is intentional.
SNW-STGINTG-DROP🔴 criticalStorage Integration dropped. External storage access removed. All dependent stages and pipes affected.
SNW-EXTACC-NEW🟡 mediumExternal access integration created. Network egress configured.
SNW-EXTACC-DROP🟠 highExternal access integration dropped. Network egress removed.
SNW-EXTACC-OFF🟠 highExternal access integration disabled. Network egress suspended.
SNW-EXTACC-ON🟡 mediumExternal access integration enabled. Network egress activated.
SNW-EXTACC-HOSTS-CHG🔴 criticalExternal access allowed hosts changed. Network egress scope modified.
SNW-EXTACC-NETRULES-CHG🟠 highExternal access network rules changed. Verify egress restrictions.
SNW-EXTACC-SECRETS-CHG🔴 criticalExternal access allowed secrets changed. Credential access modified.
SNW-EXTACC-SECRET-RMV🟠 highExternal access secret removed from allowed list.
SNW-EXTACC-NETRULE-ADD🟡 mediumNetwork rule added to external access integration.
SNW-EXTACC-NETRULE-RMV🟠 highNetwork rule removed from external access integration.
SNW-EXTACC-COMMENT-CHG🟢 lowExternal access integration comment changed.
SNW-EXTACC-TAG-ADD🟢 lowTag added to external access integration. Positive governance.
SNW-EXTACC-TAG-RMV🟡 mediumTag removed from external access integration.
SNW-EXTACC-NAME-CHG🟠 highExternal access integration renamed. Dependent objects may break.
SNW-EXTACC-OWNER-CHG🟠 highExternal access integration ownership changed.
SNW-EXTACC-CHG🟡 mediumExternal access integration modified. Verify configuration.
SNW-NETRULE-NEW🟡 mediumNetwork rule created. New network destinations or origins defined for use by network policies and external access integrations.
SNW-NETRULE-INGRESS-ANY🟠 highNetwork rule permits inbound access from all IPv4 addresses (MODE = INGRESS with 0.0.0.0/0 in VALUE_LIST). Any network policy that allows this rule imposes no source-IP restriction, exposing the account to the entire internet. Restrict the rule to the specific corporate/VPN CIDR blocks.
SNW-NETRULE-EGRESS-NEW🟠 highEgress network rule created. Outbound destinations defined — anything referencing this rule can send data to the listed endpoints.
SNW-NETRULE-VALUES-CHG🟠 highNetwork rule destinations replaced. Every policy and integration referencing this rule now allows the new endpoint list — network posture changed without any policy edit.
SNW-NETRULE-CHG🟡 mediumNetwork rule properties modified.
SNW-NETRULE-DROP🟠 highNetwork rule dropped. Policies and integrations referencing it lose the corresponding network allowances.
SNW-RESMON-NO-SUSPEND🟡 mediumResource monitor created without an automatic-suspend trigger. It can alert on credit usage but will not halt compute, so it enforces no hard spending cap.
SNW-RESMON-QUOTA-CHG🟢 lowResource monitor credit quota changed. The compute spend allowance was redefined — confirm the cap was not raised beyond budget.
SNW-RESMON-TRIGGERS-CHG🟡 mediumResource monitor triggers redefined. The credit-usage thresholds and their suspend/notify actions changed — verify automatic suspension was not loosened or removed.
SNW-RESMON-DROP🟠 highResource monitor dropped. Warehouses governed by it lose their credit-usage cap and can consume compute without automatic suspension.
SNW-CMPPOOL-NEW⚪ infoCompute pool created. Snowpark Container Services jobs and services run on this capacity; its instance family and node counts determine cost and what workloads it can host.
SNW-CMPPOOL-GPU🟢 lowCompute pool uses a GPU instance family. GPU compute is materially more expensive than CPU and can run accelerated workloads (e.g. ML training/inference). Confirm the GPU capacity is intended and cost-controlled.
SNW-GITREPO-NEW🟢 lowGit repository created. It connects Snowflake to an external git remote (ORIGIN) through an API integration; code from the repository can be run with EXECUTE IMMEDIATE FROM. Confirm the origin and integration are trusted — this is an external code-supply path into the account.
SNW-GITREPO-FETCH⚪ infoGit repository fetched. FETCH re-pulls the latest content from the external origin, so the repository's executable content now reflects whatever the upstream remote holds. Confirm the upstream is controlled.
SNW-IMGREPO-NEW⚪ infoImage repository created. It is an OCI registry that Snowpark Container Services pull container images from; whatever images are pushed here can run as containers in the account. Confirm pushes to this registry are controlled — it is a software-supply-chain surface.
SNW-IMGREPO-REPLACE🟢 lowCREATE OR REPLACE on an image repository drops the existing registry and recreates it. Container services that pull from it lose their images and will run whatever is re-pushed. Confirm the replacement is intended.
SNW-STREAMLIT-NEW⚪ infoStreamlit app created. It runs a Python app hosted from a stage and executes under the owner's role through a query warehouse. Confirm the app's stage content and warehouse are intended.
SNW-STREAMLIT-EXTERNAL-ACCESS🟡 mediumStreamlit app declares EXTERNAL_ACCESS_INTEGRATIONS — its Python code can reach external network endpoints from inside the account. Confirm the integrations are scoped and the egress is intended; this is a data-egress surface.
SNW-SERVICE-NEW🟢 lowService created (Snowpark Container Services). It runs container workloads on a compute pool from a spec that pulls container images; the images run in the account under the service's role. Confirm the spec's image sources and the compute pool are intended.
SNW-SERVICE-EXTERNAL-ACCESS🟡 mediumService declares EXTERNAL_ACCESS_INTEGRATIONS — its containers can reach external network endpoints from inside the account. Confirm the integrations are scoped and the egress is intended; this is a data-egress surface.
SNW-NOTEBOOK-NEW⚪ infoNotebook created. It runs code hosted from a stage and executes under the owner's role through a query warehouse. Confirm the notebook's stage content and warehouse are intended.
SNW-NOTEBOOK-EXTERNAL-ACCESS🟡 mediumNotebook declares EXTERNAL_ACCESS_INTEGRATIONS — its code can reach external network endpoints from inside the account. Confirm the integrations are scoped and the egress is intended; this is a data-egress surface.
SNW-SEMVIEW-REPLACE🟢 lowCREATE OR REPLACE on a semantic view redefines the model in place — the base tables it exposes and the metrics it computes can change without a separate review. Confirm the new definition's access surface is intended.
SNW-CORTEX-SEARCH-REPLACE🟢 lowCREATE OR REPLACE on a Cortex search service rebuilds the index in place — the source query it indexes and the embedding model can change without a separate review. Confirm the new definition's data source is intended.
SNW-APP-FROM-LISTING🟢 lowNative application installed FROM LISTING — its code comes from an external marketplace provider, not an in-account application package. Confirm the publisher is trusted; this is a third-party-code supply-chain surface.
SNW-APP-DEBUG-MODE🟢 lowNative application has DEBUG_MODE enabled — the provider can inspect the application's internals and objects it would otherwise not see. Confirm debug mode is intended (it is normally for development only).
SNW-APPPKG-DISTRIBUTION-EXTERNAL🟢 lowApplication package distribution set to EXTERNAL — the package can be published to and installed by other Snowflake accounts outside this organization. Confirm external distribution is intended.
SNW-LISTING-EXTERNAL🟡 mediumEXTERNAL listing — the share or application package it exposes is offered on the public Snowflake Marketplace, reaching accounts outside this organization. Confirm the data/app is intended for public exposure.
SNW-LISTING-PUBLISH🟢 lowListing published (PUBLISH = TRUE) — it is live and consumable by its target audience. Confirm the listing is ready to expose its data/app.
SNW-MANAGED-ACCOUNT-NEW🟡 mediumManaged (reader) account created. It lets people who are not Snowflake customers consume this account's shares, with compute billed to this account — a path for sharing data with outsiders. Confirm the reader account and what it will be granted are intended.
SNW-ACCOUNT-NEW🟡 mediumAccount created in the organization. A new account ships with its own ACCOUNTADMIN credentials, billing, and security posture, outside this account's controls. Confirm the provisioning is intended and the new account's admin access is governed.
SNW-STAGE-GET🟡 mediumGET downloads files from a stage to the client running this command — data leaves Snowflake to a local machine. Confirm this egress is intended and the destination is controlled; GET is a data-exfiltration primitive.
SNW-STAGE-REMOVE🟢 lowREMOVE deletes files from a stage. Confirm the deletion is intended — staged data (loads, unloads, app artifacts) is destroyed.
SNW-ALERT-NEW🟢 lowAlert created. A scheduled condition runs an action statement under the owner's role when it holds — verify the action is intended.
SNW-ALERT-DROP🟠 highAlert dropped. Scheduled monitoring and its automated action are removed.
SNW-ALERT-RESUME🟡 mediumAlert resumed. The scheduled condition and action are now active.
SNW-ALERT-SUSPEND🟢 lowAlert suspended. Scheduled evaluation paused.
SNW-ALERT-ACTION-CHG🟡 mediumAlert action SQL modified. The statement the alert runs on its schedule changed — review the new logic.
SNW-ALERT-COND-CHG🟢 lowAlert condition modified. The predicate that gates the scheduled action changed.
SNW-ALERT-PARSE-ERR🟡 mediumAlert action SQL could not be parsed. The scheduled statement was not analyzed.
SNW-DMF-DROP🟢 lowData metric function dropped. Any table still referencing it loses that data-quality metric.
SNW-REPLGRP-NEW🟡 mediumReplication group created. Account objects can be replicated to other Snowflake accounts — verify the allowed accounts and object types.
SNW-FGRP-NEW🟡 mediumFailover group created. Account objects can be replicated and failed over to other Snowflake accounts — verify the allowed accounts and object types.
SNW-REPL-ACCOUNTS🟠 highReplication/failover group grants cross-account replication. The listed ALLOWED_ACCOUNTS receive copies of this account's objects — data egresses to other Snowflake accounts.
SNW-REPL-REPLICA⚪ infoSecondary replication/failover group created (AS REPLICA OF). This account is now a replication target of another account's group.
SNW-REPLGRP-DROP🟡 mediumReplication group dropped. Cross-account replication of its objects stops.
SNW-FGRP-DROP🟡 mediumFailover group dropped. Cross-account replication and disaster-recovery failover for its objects are removed.
SNW-ACCT-UNLOAD-INLINE🔴 criticalALTER ACCOUNT SET PREVENT_UNLOAD_TO_INLINE_URL = FALSE. Data can be unloaded (COPY INTO) to arbitrary inline cloud URLs, bypassing storage-integration controls — a data-exfiltration path.
SNW-ACCT-STAGE-INTEG-OFF🟠 highALTER ACCOUNT relaxes the storage-integration requirement for stages (REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION/OPERATION = FALSE). Stages may then embed inline cloud credentials.
SNW-ACCT-RETENTION-ZERO🟠 highALTER ACCOUNT SET DATA_RETENTION_TIME_IN_DAYS = 0 disables Time Travel account-wide. Objects using the account default lose their recovery window: dropped or modified data cannot be restored with UNDROP or AT/BEFORE queries, eliminating recovery from accidental or malicious data loss.
SNW-ACCT-MIN-RETENTION-ZERO🟡 mediumALTER ACCOUNT SET MIN_DATA_RETENTION_TIME_IN_DAYS = 0 removes the enforced Time Travel floor, allowing any database, schema, or table to set DATA_RETENTION_TIME_IN_DAYS = 0 and disable its own data recovery.
SNW-ACCT-NETPOL-UNSET🟠 highALTER ACCOUNT UNSET NETWORK_POLICY removes the account-level network policy. IP allow/block restrictions no longer apply account-wide.
SNW-ACCT-NETPOL-SET🟡 mediumALTER ACCOUNT SET NETWORK_POLICY changes the account-level network policy. Verify the policy enforces the intended IP restrictions.
SNW-ACCT-REKEY-OFF🟡 mediumALTER ACCOUNT SET PERIODIC_DATA_REKEYING = FALSE disables periodic re-encryption of stored data with fresh keys.
SNW-ACCT-UNREDACTED-ERR🟡 mediumALTER ACCOUNT SET ENABLE_UNREDACTED_QUERY_SYNTAX_ERROR = TRUE exposes literal values from failed queries in error messages and the query history.
SNW-SECRET-NEW🟡 mediumSecret created. Credential material is now stored for outbound authentication — verify ownership and intended consumers.
SNW-SECRET-ROTATED🟡 mediumSecret credential value replaced. Legitimate rotation is routine; an unexpected replacement can redirect authentication to attacker-controlled credentials.
SNW-SECRET-AUTH-CHG🟡 mediumSecret's API authentication integration changed. The secret now authenticates through a different provider.
SNW-SECRET-CHG🟢 lowSecret properties modified.
SNW-SECRET-DROP🟠 highSecret dropped. Integrations and external-access functions that authenticate with it will fail.
SNW-SHARE-NEW🟡 mediumShare created. Cross-account data sharing container configured — objects granted to it become shareable outside the account.
SNW-SHARE-ACCOUNTS-ADD🔴 criticalConsumer accounts added to share. Everything granted to this share becomes readable from the listed external accounts.
SNW-SHARE-ACCOUNTS-SET🔴 criticalShare consumer-account list replaced. Verify every account in the new list is an approved data recipient.
SNW-SHARE-ACCOUNTS-RMV🟢 lowConsumer accounts removed from share. External access for the listed accounts is revoked.
SNW-SHARE-CHG🟡 mediumShare properties modified. Verify sharing configuration.
SNW-SHARE-DROP🟡 mediumShare dropped. All consumer accounts lose access to the shared data.
SNW-SECINTG-NEW🟡 mediumSecurity integration created. New authentication provider (OAuth, SAML, SCIM) configured for the account.
SNW-SECINTG-DROP🟠 highSecurity integration dropped. Authentication provider removed — sign-in flows and provisioning that depend on it will fail.
SNW-SECINTG-OFF🟠 highSecurity integration disabled. Dependent single sign-on or provisioning flows are suspended.
SNW-SECINTG-ON🟡 mediumSecurity integration enabled. Authentication provider activated.
SNW-SECINTG-CHG🟡 mediumSecurity integration properties changed. Authentication provider configuration modified — verify the new settings.
SNW-SECINTG-UNSET🟡 mediumSecurity integration properties removed. Authentication provider settings reverted to defaults.
SNW-SECINTG-NAME-CHG🟢 lowSecurity integration renamed. References by the old name in automation or documentation may break.
SNW-SECINTG-OAUTH-NON-TLS-REDIRECT🟠 highOAuth security integration allows a non-TLS redirect URI (OAUTH_ALLOW_NON_TLS_REDIRECT_URI = TRUE). The authorization code can be sent to a plaintext http:// endpoint, exposing it to man-in-the-middle interception and redirect-phishing. Require a TLS-protected redirect URI.
SNW-SECINTG-EXTOAUTH-ANY-ROLE🟠 highExternal OAuth integration enables unrestricted role switching (EXTERNAL_OAUTH_ANY_ROLE_MODE = ENABLE). An authenticated client can assume any role granted to the mapped user as its session role with no further restriction — a privilege-escalation surface. Use DISABLE, or ENABLE_FOR_PRIVILEGE to require the USE_ANY_ROLE privilege.
SNW-SECINTG-SCIM-RUN-AS-PRIV🟠 highSCIM security integration provisions as a privileged system role (RUN_AS_ROLE is ACCOUNTADMIN, SECURITYADMIN, SYSADMIN, ORGADMIN, or USERADMIN). Users and roles imported by the identity provider are owned and managed by that role, granting the external provisioning client account-wide authority. Run SCIM as a dedicated least-privilege provisioner role.
SNW-SECINTG-SAML-SIGN-REQUEST-OFF🟡 mediumSAML2 integration sends unsigned authentication requests (SAML2_SIGN_REQUEST = FALSE). The identity provider cannot cryptographically verify that requests originate from this Snowflake account, weakening protection against request forgery. Enable request signing.
SNW-SECINTG-SCIM-SYNC-PASSWORD🟡 mediumSCIM security integration synchronizes passwords from the identity provider (SYNC_PASSWORD = TRUE). Password material is pushed into Snowflake from the external client, broadening where credentials live. Verify password sync is required and the provider channel is trusted.
SNW-NOTIFINTG-NEW🟢 lowNotification integration created. External notification configured.
SNW-NOTIFINTG-CHG🟢 lowNotification integration modified. Verify configuration.
SNW-DYNTBL-NEW🟢 lowDynamic table created. Materialized view with automatic refresh.
SNW-DYNTBL-PARSE-ERR🟡 mediumDynamic table query could not be parsed. Lineage extraction incomplete.
SNW-DYNTBL-DROP🟠 highDynamic table dropped. Materialized view and automatic refresh removed.
SNW-DYNTBL-SUSP🟢 lowDynamic table suspended. Automatic refresh paused.
SNW-DYNTBL-RESUME🟢 lowDynamic table resumed. Automatic refresh reactivated.
SNW-DYNTBL-NAME-CHG🟡 mediumDynamic table renamed. Update dependent references.
SNW-DYNTBL-SWAP🟡 mediumDynamic table swapped with another. Verify data integrity.
SNW-DYNTBL-TAG-ADD🟢 lowTag set on dynamic table. Positive governance signal for metadata tracking.
SNW-DYNTBL-TAG-RMV🟡 mediumTag removed from dynamic table. Verify governance metadata tracking is maintained.
SNW-DYNTBL-RAP-ADD🟡 mediumRow access policy applied to dynamic table. Access controls configured.
SNW-DYNTBL-RAP-RMV🟠 highRow access policy removed from dynamic table. Access controls weakened.
SNW-DYNTBL-MASK-ADD🟡 mediumMasking policy applied to dynamic table column. Data protection configured.
SNW-DYNTBL-MASK-RMV🟠 highMasking policy removed from dynamic table column. Data protection weakened.
SNW-PIPE-NEW🟢 lowPipe created. Data loading pipeline configured.
SNW-PIPE-AUTOINGEST🟡 mediumPipe created with AUTO_INGEST = TRUE. Data will be loaded automatically when files arrive in stage.
SNW-PIPE-DROP🟠 highPipe dropped. Data loading pipeline removed. Incoming data will no longer be auto-loaded.
SNW-PIPE-SET🟢 lowPipe properties modified via SET.
SNW-PIPE-TAG-SET🟢 lowTag assigned to pipe. Governance metadata applied.
SNW-PIPE-TAG-UNSET🟡 mediumTag removed from pipe. Governance metadata lost.
SNW-PIPE-REFRESH🟢 lowPipe manually refreshed. Staged files will be re-evaluated for loading.
SNW-TAG-MASK-ADD🟢 lowMasking policy attached to tag. Every column carrying this tag will be masked by the policy.
SNW-TAG-MASK-FORCE🟡 mediumMasking policy attached to tag with FORCE. An existing policy of the same data type is replaced — masking behavior changes for every column carrying this tag.
SNW-TAG-MASK-RMV🔴 criticalMasking policy detached from tag. Every column carrying this tag loses the policy's protection and is unmasked unless covered by another policy.
SNW-TAG-ALLOWED-RMV🟢 lowAllowed values removed from tag. Rows tagged with the removed values keep them; the values can no longer be newly assigned.
SNW-TAG-ALLOWED-UNSET🟡 mediumTag allowed-values constraint removed. Any string value becomes assignable, weakening classification consistency.
SNW-TAG-RENAME🟢 lowTag renamed. References to the old tag name in policies, reports, and automation may break.
SNW-TAG-PROPAGATE-OFF🟢 lowTag propagation disabled. The tag will no longer propagate to dependent or derived objects.
SNW-TAG-DROP🟠 highTag dropped. The classification is removed from every tagged object and any tag-based policy assignments are detached.
SNW-FILEFORMAT-REPLACE🟡 mediumFile format replaced with OR REPLACE. Parsing behavior changes for every COPY and external table that references it, silently altering how subsequent loads interpret data.
SNW-FILEFORMAT-RENAME🟢 lowFile format renamed. COPY statements and external tables referencing the old name will fail until updated.
SNW-FILEFORMAT-DROP🟠 highFile format dropped. Every COPY statement and external table that references it will fail to load data until the format is recreated or the reference is changed.
SNW-SESSION-STMT-TIMEOUT-OFF🟢 lowStatement timeout disabled for the session (STATEMENT_TIMEOUT_IN_SECONDS = 0). Queries in this session can run unbounded — review for runaway-cost exposure.
SNW-SESSION-KEEPALIVE-ON🟡 mediumClient session keep-alive enabled (CLIENT_SESSION_KEEP_ALIVE = TRUE). The session no longer expires on inactivity, weakening session-expiration and re-authentication controls.
SNW-SESSION-NONDETERMINISTIC-DML🟢 lowNondeterministic MERGE/UPDATE error disabled. The session silently allows MERGE/UPDATE statements with ambiguous row matches, risking nondeterministic writes and data corruption.
SNW-SESSION-GRANT-UNDER-ACCOUNTADMIN🟡 mediumPrivilege granted while ACCOUNTADMIN is the active role. Manage grants under SECURITYADMIN or a dedicated security-admin role rather than the account super-role, to keep privilege administration separate from account administration.
SNW-STREAM-NEW🟢 lowStream created. CDC tracking enabled on source object.
SNW-STREAM-APPENDONLY🟢 lowStream configured with APPEND_ONLY mode. Only INSERT operations will be tracked.
SNW-STREAM-INSERTONLY🟢 lowStream configured with INSERT_ONLY mode for external table.
SNW-STREAM-DROP🟠 highStream dropped. CDC tracking removed - downstream consumers may be affected.
SNW-SCHEMA-MGDACC-NEW🟢 lowSchema created with MANAGED ACCESS. Centralized privilege management enabled - only schema owner can grant privileges.
SNW-SCHEMA-MGDACC-ON🟢 lowSchema MANAGED ACCESS enabled. Centralized privilege management now active - only schema owner can grant privileges on objects.
SNW-SCHEMA-MGDACC-OFF🟠 highSchema MANAGED ACCESS disabled. Object owners can now grant privileges. Review privilege grants for compliance.
SNW-SCHEMA-RETENTION-CHG🟠 highSchema data retention period changed. Time Travel and Fail-safe capabilities for all objects in schema may be affected.
SNW-SCHEMA-RETENTION-ZERO🟠 highALTER SCHEMA SET DATA_RETENTION_TIME_IN_DAYS = 0 disables Time Travel for every object in the schema that uses the schema default. Dropped or modified data cannot be restored with UNDROP or AT/BEFORE queries — there is no recovery window for accidental or malicious data loss.
SNW-SCHEMA-SWAP🟠 highSchema swapped with another schema. All objects exchanged between schemas. Verify access controls.
SNW-EXTVOL-CLOUD-ACCESS🟢 lowExternal volume backs its data with external cloud object storage and assumes a cloud IAM role (STORAGE_AWS_ROLE_ARN) to reach the bucket. Review the role's trust policy and the bucket's access scope — this grants Snowflake standing access to storage outside its boundary.
SNW-EXTVOL-WRITABLE🟡 mediumExternal volume created with ALLOW_WRITES = TRUE. Snowflake can write data out to the external object store, not just read from it — a data-egress surface. Confirm write access to this external location is intended.
SNW-EXTVOL-ENC-NONE🟡 mediumExternal volume storage location specifies ENCRYPTION TYPE = NONE. Data written to this external object store is not server-side encrypted by the configured scheme. Confirm an alternative encryption control is in place.
SNW-CONN-REPLICA🟢 lowConnection created AS REPLICA OF a connection in another account. This account now mirrors a connection owned elsewhere for cross-account failover/DR. Confirm the source account and the replication relationship are authorized.
SNW-CONN-FAILOVER-ENABLE🟡 mediumENABLE FAILOVER opens this connection — and any credentials it carries — to failover into the listed accounts. The connection becomes usable from those accounts. Confirm every target account is authorized to assume this connection.
SNW-ROLE-PRIV-USE🔴 criticalPrivileged role should not be hardcoded in scripts. Use role grants or session variables instead.
SNW-TASK-NEW🟢 lowScheduled task created. Automated SQL execution configured.
SNW-TASK-DROP🟠 highScheduled task dropped. Automated workflow removed.
SNW-TASK-RESUME🟡 mediumTask resumed. Automated execution is now active.
SNW-TASK-SUSPEND🟢 lowTask suspended. Automated execution paused.
SNW-TASK-BODY-CHG🟡 mediumTask SQL body modified. Review the new logic for correctness.
SNW-TASK-DEP-CHG🟡 mediumTask dependency chain modified. Verify DAG execution order.
SNW-TASK-EXECAS🟠 highTask EXECUTE AS configured. Verify privilege escalation is intentional.
SNW-TASK-PARSE-ERR🟡 mediumTask body SQL could not be parsed. Lineage extraction incomplete.
SNW-TASK-OVERLAP-ALL🟠 highOVERLAP_POLICY = ALLOW_ALL_OVERLAP. Multiple instances of the entire task graph, including the root task, can run concurrently. Risk of resource contention, duplicate processing, and data races.
SNW-TASK-OVERLAP-CHILD🟡 mediumOVERLAP_POLICY = ALLOW_CHILD_OVERLAP. A new task graph instance starts while child tasks are still running. Verify child tasks are idempotent.
SNW-DB-FROM-SHARE🟠 highDatabase created from share. Data is being accessed from external provider. Verify data governance compliance.
SNW-DB-REPLICA🟡 mediumDatabase created as replica. Data is being replicated from another region/account.
SNW-DB-SWAP🟠 highDatabase swapped with another database. All objects exchanged between databases. Verify access controls.
SNW-DB-RETENTION-CHG🟠 highDatabase data retention period changed. Time Travel and Fail-safe capabilities may be affected.
SNW-DB-RETENTION-ZERO🟠 highALTER DATABASE SET DATA_RETENTION_TIME_IN_DAYS = 0 disables Time Travel for every object in the database that uses the database default. Dropped or modified data cannot be restored with UNDROP or AT/BEFORE queries — there is no recovery window for accidental or malicious data loss.
SNW-TBL-RETENTION-ZERO🟡 mediumTable set with DATA_RETENTION_TIME_IN_DAYS = 0, disabling Time Travel for the table. Dropped or modified rows cannot be recovered with UNDROP or AT/BEFORE queries — there is no recovery window for accidental or malicious changes. Permanent tables holding retained data should keep a non-zero retention period.
SNW-DB-REPL-ON🟠 highDatabase replication enabled. Data will be replicated to other accounts/regions. Verify compliance with data residency requirements.
SNW-DB-REPL-OFF🟠 highDatabase replication disabled. Disaster recovery capabilities reduced.
SNW-DB-FAILOVER-ON🟡 mediumDatabase failover enabled. Account can be promoted as failover target.
SNW-DB-FAILOVER-OFF🟠 highDatabase failover disabled. Disaster recovery failover capability removed.
SNW-DB-FAILOVER-PROMOTE🔴 criticalDatabase promoted to primary. This is a failover event. The database is now writable and replication direction has changed.
SNW-DB-REFRESH🟡 mediumDatabase refresh initiated from primary. Local changes may be overwritten.
SNW-WH-NEW🟢 lowWarehouse created. New compute resource provisioned.
SNW-WH-LARGE🟡 mediumWarehouse created with very large size (4XL+). Significant cost impact — verify workload justifies size.
SNW-WH-SNOWPARK🟡 mediumSnowpark-optimized warehouse created. Specialized compute for ML/data engineering workloads.
SNW-WH-NO-AUTOSUSPEND🟡 mediumWarehouse auto-suspend disabled (AUTO_SUSPEND = 0). Credits will be consumed continuously.
SNW-WH-MULTICLUSTER🟢 lowMulti-cluster warehouse configured. Scaling parameters affect cost and concurrency.
SNW-WH-DROP🔴 criticalDROP WAREHOUSE detected. Compute resource permanently removed. Active queries and dependent tasks will fail.
SNW-WH-SUSPEND🟢 lowWarehouse suspended. Compute paused — no credits consumed while suspended.
SNW-WH-RESUME🟡 mediumWarehouse resumed. Compute is now active and consuming credits.
SNW-WH-ABORT🟠 highABORT ALL QUERIES on warehouse. All running queries terminated immediately.
SNW-WH-RENAME🟡 mediumWarehouse renamed. References using old name will break.
SNW-WH-SIZE-CHG🟡 mediumWarehouse size changed. Cost and performance characteristics altered.
SNW-WH-SET🟢 lowWarehouse properties modified via SET.
SNW-WH-TAG-SET🟢 lowTag assigned to warehouse. Governance metadata applied.
SNW-WH-TAG-UNSET🟡 mediumTag removed from warehouse. Governance metadata lost.
SNW-ICEBERG-TABLE🟢 lowIceberg table created. Its data resides in an external object-storage volume (EXTERNAL VOLUME) governed by an Iceberg catalog rather than Snowflake-managed storage. Confirm the external volume's cloud credentials, bucket policy, and catalog access are governed — table data sits outside Snowflake's storage boundary.
SNW-EVENT-TABLE🟢 lowEvent table created. Event tables capture log and trace events emitted by procedures, functions, and sessions; their payloads may contain sensitive data. Confirm access controls and a retention policy are in place.
SNW-EXECIMM-FROM-STAGE🟡 mediumEXECUTE IMMEDIATE FROM runs SQL loaded from a stage file rather than inline in the script. The executed code is not visible at review time — verify the stage's access controls and the file's provenance, as this is an external/file-based code-execution surface (e.g. running unreviewed scripts or git-repository files).
SNW-EXTFUNC-NON-TLS🟠 highEXTERNAL FUNCTION sends row data to a non-TLS (http://) endpoint. Column values passed to the function — including any sensitive data — travel to the remote service in plaintext and can be intercepted on the network. Use an https:// endpoint.
SNW-EXTFUNC-NEW⚪ infoEXTERNAL FUNCTION declared — row data is sent to an external service via an API integration (a data-egress channel). Confirm the endpoint URL and API integration are approved, and that no sensitive columns are passed to an untrusted destination.

BigQuery (BQ-xxx)

Rule IDRiskDescription
BQ-SNAP-TBL-NEW🟢 lowSnapshot table created. Point-in-time clone of source table.
BQ-SNAP-TBL-DROP🟡 mediumSnapshot table dropped. Point-in-time recovery path removed for this dataset.
BQ-SEARCHIDX-NEW🟢 lowSearch index created for full-text search capabilities.
BQ-SEARCHIDX-DROP🟡 mediumSearch index dropped. Full-text search performance on this table may degrade.
BQ-VECIDX-NEW🟢 lowVector index created for ML embedding similarity search.
BQ-VECIDX-CHG🟢 lowVector index modified (e.g., REBUILD). Validate embedding search quality/performance baselines.
BQ-VECIDX-DROP🟡 mediumVector index dropped. ML embedding search performance on this table may degrade.
BQ-MODEL-NEW🟢 lowBigQuery ML model created. Training data pipeline established.
BQ-MODEL-DROP🟡 mediumBigQuery ML model dropped. Dependent prediction queries will fail.
BQ-MODEL-CHG🟢 lowBigQuery ML model options modified.
BQ-MODEL-EXPORT🟡 mediumBigQuery ML model exported to external storage. Model artifacts leaving BigQuery.
BQ-ASSERT-CFG🟢 lowASSERT statement present. Data quality/runtime invariant check is enforced.
BQ-ASSERT-NODESC🟢 lowASSERT statement missing descriptive message. Failures may be harder to triage in logs and runtime pipelines.
BQ-MODEL-REMOTE🟠 highBigQuery ML model uses REMOTE WITH CONNECTION. Model calls external endpoint — review connection security and data exposure.
BQ-EXPORT-UNBOUNDED🟠 highEXPORT DATA exports query results to external storage without WHERE filtering. Full table contents may be exposed.
BQ-MODEL-UNBOUNDED🟠 highBQML training query has no WHERE/filter conditions. Model may train on unintended full datasets.
BQ-EXPORT-AWS-LEAK🔴 criticalHardcoded AWS access key detected in EXPORT DATA statement. Use secure credential management instead.
BQ-EXPORT-PWD-LEAK🔴 criticalHardcoded password detected in EXPORT DATA statement. Use secure parameter passing instead.
BQ-EXPORT-APIKEY-LEAK🔴 criticalHardcoded API key or access token detected in EXPORT DATA statement. Store API keys in secure secrets managers.
BQ-EXPORT-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected in EXPORT DATA statement. Use secure credential storage.
BQ-LOAD-AWS-LEAK🔴 criticalHardcoded AWS access key detected in LOAD DATA statement. Use secure credential management instead.
BQ-LOAD-PWD-LEAK🔴 criticalHardcoded password detected in LOAD DATA statement. Use secure parameter passing instead.
BQ-LOAD-APIKEY-LEAK🔴 criticalHardcoded API key or access token detected in LOAD DATA statement. Store API keys in secure secrets managers.
BQ-LOAD-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected in LOAD DATA statement. Use secure credential storage.
BQ-EXTTBL-AWS-LEAK🔴 criticalHardcoded AWS access key detected in CREATE EXTERNAL TABLE/SCHEMA. Use secure credential management instead.
BQ-EXTTBL-PWD-LEAK🔴 criticalHardcoded password detected in CREATE EXTERNAL TABLE/SCHEMA. Use secure parameter passing instead.
BQ-EXTTBL-APIKEY-LEAK🔴 criticalHardcoded API key or access token detected in CREATE EXTERNAL TABLE/SCHEMA. Store API keys in secure secrets managers.
BQ-EXTTBL-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected in CREATE EXTERNAL TABLE/SCHEMA. Use secure credential storage.
BQ-MODEL-AWS-LEAK🔴 criticalHardcoded AWS access key detected in CREATE/ALTER/EXPORT MODEL. Use secure credential management instead.
BQ-MODEL-PWD-LEAK🔴 criticalHardcoded password detected in CREATE/ALTER/EXPORT MODEL. Use secure parameter passing instead.
BQ-MODEL-APIKEY-LEAK🔴 criticalHardcoded API key or access token detected in CREATE/ALTER/EXPORT MODEL. Store API keys in secure secrets managers.
BQ-MODEL-CONNSTR-LEAK🔴 criticalConnection string with embedded credentials detected in CREATE/ALTER/EXPORT MODEL. Use secure credential storage.
BQ-LOAD-EXTSTORE🟡 mediumLOAD DATA references external cloud storage (GCS/S3/Azure). Verify source data integrity and access controls.
BQ-EXTTBL-EXTSTORE🟡 mediumCREATE EXTERNAL TABLE/SCHEMA references external cloud storage (GCS/S3/Azure). Verify source integrity and access boundaries.
BQ-MODEL-EXPORT-EXTSTORE🟡 mediumEXPORT MODEL writes artifacts to external cloud storage. Verify destination boundaries and retention controls.

PostgreSQL (PG-xxx)

Rule IDRiskDescription
PG-DOMAIN-DROP🟠 highDomain dropped. Columns using this domain type will be affected.
PG-DOMAIN-CASCADE-DROP🔴 criticalDomain dropped with CASCADE. All dependent columns, constraints, and types will be removed.
PG-DOMAIN-NAME-CHG🟢 lowDomain renamed. Verify all dependent columns and types reference the new name.
PG-DOMAIN-OWNER-CHG🟡 mediumDomain ownership changed. Verify the new owner has appropriate permissions.
PG-DOMAIN-NOTNULL-DROP🟠 highNOT NULL constraint removed from domain. Columns using this domain may now accept NULL values, potentially causing data quality issues.
PG-DOMAIN-CONSTR-DROP🟠 highConstraint removed from domain. Data validation enforced by this constraint is no longer active.
PG-DOMAIN-CONSTR-CASCADE-DROP🔴 criticalDomain constraint dropped with CASCADE. Cascading removal may affect dependent objects and columns.
PG-DOMAIN-CHG🟡 mediumDomain altered. Review changes to ensure data type semantics remain correct.
PG-RLS-CHG🟡 mediumRow-level security policy modified. Review the updated USING/WITH CHECK expressions to ensure data access remains correctly restricted.
PG-RLS-NAME-CHG🟢 lowRow-level security policy renamed. Verify dependent references are updated.
PG-RLS-DROP🔴 criticalRow-level security policy dropped. Row-level data protection removed. All rows may become visible to users who were previously restricted.
PG-RLS-CASCADE-DROP🔴 criticalRow-level security policy dropped with CASCADE. Cascading removal may affect dependent objects beyond this policy.
PG-RLS-TABLE-DISABLE🔴 criticalALTER TABLE ... DISABLE ROW LEVEL SECURITY. Row-level protection is switched off for the table — every row becomes visible to any role with table access, bypassing all attached policies. Verify this is intended.
PG-RLS-TABLE-NO-FORCE🟡 mediumALTER TABLE ... NO FORCE ROW LEVEL SECURITY. The table owner is once again exempt from row-level security policies. Owner queries will see all rows regardless of policy. Verify the owner exemption is intended.
PG-RLS-PERMISSIVE🟡 mediumRLS policy created as PERMISSIVE. Multiple permissive policies are combined with OR, which may be less restrictive than intended. Consider RESTRICTIVE policies for tighter control.
PG-RLS-WEAK-CHECK🔴 criticalPostgreSQL RLS policy WITH CHECK expression is always true. Policy does not restrict write operations — any row can be inserted or updated.
PG-COPY-FROM🟡 mediumCOPY FROM imports data into a table. Verify the data source is trusted and the target table is correct.
PG-COPY-TO🟠 highCOPY TO exports data from a table. This may expose sensitive data — verify authorization and destination.
PG-COPY-PROGRAM🔴 criticalCOPY with PROGRAM executes a shell command on the server. CRITICAL SECURITY RISK: This allows arbitrary command execution with database server privileges.
PG-FDW-SERVER-REMOTE🟡 mediumForeign server registered through a network / file foreign-data wrapper. Queries against its foreign tables reach an external system (a remote database, or — for file_fdw — server-side files), crossing the instance boundary. Verify the endpoint and the user mapping's credentials are authorized.
PG-FDW-SERVER-OPTIONS-MODIFIED🟡 mediumForeign server reconfigured through its OPTIONS bag. These settings carry the remote endpoint (host, dbname, port, …), so altering them can silently repoint every dependent foreign table at a different external system without touching any table or user mapping. Verify the new endpoint is authorized.
PG-FDW-USER-MAPPING-PUBLIC🟡 mediumUser mapping FOR PUBLIC. Every local role — present and future — inherits these credentials when querying the foreign server's tables, widening who can reach the remote system. Prefer mapping specific roles.
PG-FDW-IMPORT-FOREIGN-SCHEMA-BROAD🟡 mediumIMPORT FOREIGN SCHEMA exposes a remote schema's tables locally in bulk without an explicit allow-list. A whole foreign schema (or all-but-a-few of it) becomes queryable across the instance boundary in one statement, and tables added remotely later are not re-reviewed. Prefer LIMIT TO with an explicit table list to scope the federated surface.
PG-EXT-NEW🟠 highCREATE EXTENSION installs server-side code (C functions, operators, types). Some extensions (e.g. dblink, postgres_fdw, pg_stat_statements) grant powerful capabilities. Requires superuser or trusted extension support.
PG-EXT-CASCADE-NEW🔴 criticalCREATE EXTENSION ... CASCADE installs the extension AND all its dependencies automatically. Dependencies are installed without explicit review, increasing the attack surface.
PG-MATVIEW-REFRESH🟢 lowMaterialized view refreshed. This rebuilds the cached data from the underlying query.
PG-IDX-REBUILD🟡 mediumREINDEX rebuilds indexes. This may cause temporary performance impact and lock contention.
PG-IDX-NAME-CHG🟢 lowIndex renamed. Update any references to this index.
PG-IDX-CHG🟡 mediumIndex altered (tablespace or properties changed). Review impact on query performance.
PG-TRIG-NAME-CHG🟢 lowTrigger renamed. Update any references to this trigger.
PG-TRIG-CASCADE-DROP🔴 criticalTrigger dropped with CASCADE. Cascading removal may affect dependent objects.
PG-IDX-DROP🟢 lowDROP INDEX removes an index. May degrade query performance on dependent queries.
PG-IDX-CASCADE-DROP🟡 mediumDROP INDEX ... CASCADE removes an index and all dependent objects.
PG-EXT-DROP🟠 highDROP EXTENSION removes a PostgreSQL extension. Security extensions (pgcrypto, pg_audit) may be silently removed, weakening data protection.
PG-EXT-CASCADE-DROP🔴 criticalDROP EXTENSION ... CASCADE removes the extension AND all dependent objects. This can silently drop functions, views, and columns that depend on extension types.
PG-TRIG-OFF🔴 criticalALTER TABLE ... DISABLE TRIGGER disables a trigger. Audit triggers, referential integrity triggers, and security enforcement triggers will stop firing. This is a common attack vector.
PG-ROLE-SUPERUSER🔴 criticalRole granted SUPERUSER. A superuser bypasses all permission checks and can read/modify any data, alter the server, and create more superusers. Grant only to trusted administrative principals.
PG-ROLE-BYPASSRLS🟠 highRole granted BYPASSRLS. The principal bypasses every row-level security policy, seeing all rows regardless of USING/WITH CHECK expressions. Verify this is intended for the role.
PG-ROLE-CREATEROLE🟠 highRole granted CREATEROLE. The principal can create, alter, and drop other roles — including granting itself further privileges — a privilege-escalation path. Verify the role requires role-management capability.
PG-ROLE-REPLICATION🟡 mediumRole granted REPLICATION. The principal can initiate streaming replication and manage replication slots, enabling a full copy of the cluster's data. Verify the role is a replication account.
PG-ROLE-SET🟠 highSET ROLE or SET SESSION AUTHORIZATION changes the current session identity. This can escalate privileges or impersonate other users.
PG-SESSION-CHG🟡 mediumSET or RESET modifies session configuration (search_path, etc.). search_path changes can enable schema hijacking attacks.
PG-SESSION-SET🟢 lowSET modifies a session configuration parameter.
PG-SESSION-DISCARD🟡 mediumDISCARD resets session state (plans, sequences, temporary objects). Verify this is intentional.
PG-RULE-NEW🟠 highCREATE RULE defines a query rewrite rule. Rules silently transform queries, which can lead to unexpected behavior. Consider triggers as a more transparent alternative.
PG-RULE-CHG🟡 mediumALTER RULE modifies a PostgreSQL query rewrite rule. Rules can redirect INSERT/UPDATE/DELETE to different tables, affecting data integrity.
PG-RULE-DROP🟠 highDROP RULE removes a query rewrite rule. If the rule enforced data routing or security constraints, those protections are removed.
PG-OWNED-DROP🔴 criticalDROP OWNED removes all objects owned by the specified roles. This is a mass deletion operation that can cause significant data loss.
PG-OWNED-REASSIGN🟠 highREASSIGN OWNED transfers ownership of all objects from one role to another. Verify the target role has appropriate permissions.
PG-TBLSPC-NEW🟢 lowCREATE TABLESPACE defines a new storage location for database objects.
PG-TBLSPC-CHG🟡 mediumALTER TABLESPACE modifies storage configuration (location, options, ownership). Review impact on I/O performance and storage allocation.
PG-TBLSPC-DROP🟡 mediumDROP TABLESPACE removes a storage location. Objects in this tablespace must be relocated first.
PG-PUB-CHG🟡 mediumLogical replication publication modified. Changes affect which data is replicated to subscribers.
PG-SUB-CHG🟡 mediumLogical replication subscription modified. Changes affect data replication from the publisher.
PG-SYS-CFG-CHG🔴 criticalALTER SYSTEM modifies server-level configuration parameters. This affects all databases and users on the server. Changes take effect after reload/restart.
PG-TBL-LOCK🟠 highExplicit table lock acquired. This can cause blocking and deadlocks. Verify the lock mode is appropriate.
PG-RULE-CASCADE-DROP🟠 highDROP RULE ... CASCADE removes the rule AND all dependent objects. Cascading drops can affect data integrity constraints.
PG-TYPE-DROP🟢 lowDROP TYPE removes a user-defined type. Columns or functions using this type will break.
PG-TYPE-CASCADE-DROP🟡 mediumDROP TYPE ... CASCADE removes the type and all dependent columns, functions, and casts.
PG-ANON-EXEC🟠 highDO $ block executes anonymous code. Cannot be tracked by name, audited, or rolled back. Review for privilege escalation, data modification, and unintended side effects.
PG-VIEW-SECINV-OFF🟡 mediumThe view explicitly sets security_invoker = false: its query runs with the view owner's privileges, and row-level security policies on the underlying tables are evaluated against the owner rather than the caller. Any user granted SELECT on the view reads through the owner's rights — the standard shape for exposing RLS-protected rows through a view. Set security_invoker = true unless owner-rights access is intended.
PG-DEFAULT-PRIV-TO-PUBLIC🟠 highALTER DEFAULT PRIVILEGES grants to PUBLIC. Every object of this class created in the future is automatically accessible to every role, with no further grant. This is a standing policy that is easy to forget; grant defaults to a specific role instead.
PG-DEFAULT-PRIV-ALL🟡 mediumALTER DEFAULT PRIVILEGES grants ALL privileges by default. Every object of this class created in the future receives the full privilege set automatically. Default to the minimum privileges the grantee actually needs.
PG-DEFAULT-PRIV-GLOBAL🟢 lowALTER DEFAULT PRIVILEGES has no IN SCHEMA clause, so the default applies to objects created in every schema. Confine standing default grants to the schemas that need them with IN SCHEMA.

Databricks (DBX-xxx)

Rule IDRiskDescription
DBX-GRT-CAT-ALLPRIV🔴 criticalGRANT ALL PRIVILEGES ON CATALOG detected. This grants every privilege on the entire Unity Catalog namespace — including all schemas, tables, views, and volumes within it. Use fine-grained grants (e.g., USE CATALOG, CREATE SCHEMA) instead.
DBX-GRT-CAT-MANAGE🔴 criticalGRANT MANAGE ON CATALOG detected. MANAGE provides broad administrative control over Unity Catalog objects and permissions. Verify this grant is explicitly approved.
DBX-GRT-CAT-MODIFY🔴 criticalGRANT MODIFY ON CATALOG detected. MODIFY in Databricks combines INSERT, UPDATE, and DELETE privileges on ALL current and future tables in the catalog. This is equivalent to granting full DML on every table. Use schema- or table-level grants instead.
DBX-GRT-SCHEMA-MANAGE🟠 highGRANT MANAGE ON SCHEMA detected. MANAGE allows delegated privilege administration within the schema. Ensure least-privilege scope and approval.
DBX-GRT-SCHEMA-MODIFY🟠 highGRANT MODIFY ON SCHEMA detected. MODIFY combines INSERT, UPDATE, and DELETE on all current and future tables in the schema. Verify this scope is intended.
DBX-GRT-VOL-MANAGE🟠 highGRANT MANAGE ON VOLUME detected. This enables broad administration over Unity Catalog volume access and metadata. Verify governance intent.
DBX-GRT-EXTUSE-LOC🔴 criticalGRANT EXTERNAL USE LOCATION detected. This allows temporary credential vending for external processing engines to access Unity Catalog external locations. CRITICAL data exfiltration risk — ALL PRIVILEGES intentionally excludes this privilege.
DBX-GRT-EXTUSE-SCHEMA🔴 criticalGRANT EXTERNAL USE SCHEMA detected. This allows temporary credential vending for external engines to access tables via Iceberg REST APIs. CRITICAL data exfiltration risk — ALL PRIVILEGES intentionally excludes this privilege.
DBX-GRT-EXTLOC-WRFILES🟠 highGRANT WRITE FILES detected. This allows direct writes to cloud object storage configured as an external location. Databricks recommends using WRITE VOLUME instead for governed access.
DBX-GRT-EXTLOC-RDFILES🟡 mediumGRANT READ FILES detected. This allows direct reads from cloud object storage configured as an external location. Databricks recommends using READ VOLUME instead for governed access.
DBX-GRT-CRED-CREATE🟠 highGRANT CREATE STORAGE CREDENTIAL detected. This allows the grantee to create new cloud storage credentials in the metastore — a highly privileged infrastructure operation.
DBX-GRT-EXTLOC-CREATE🟠 highGRANT CREATE EXTERNAL LOCATION detected. This allows the grantee to map new cloud storage paths into Unity Catalog — a privileged infrastructure operation.
DBX-GRT-SHARE-SETPERM🟠 highGRANT SET SHARE PERMISSION detected. Combined with USE SHARE and USE RECIPIENT, this enables the grantee to share data with external organizations via Delta Sharing. Verify data-sharing authorization.
DBX-RVK-CAT-ALLPRIV🟠 highREVOKE ALL PRIVILEGES ON CATALOG detected. This can immediately remove broad access and disrupt workloads. Verify blast radius and rollout timing.
DBX-RVK-CAT-MANAGE🟡 mediumREVOKE MANAGE ON CATALOG detected. Catalog-level administrative control is being removed from a principal. Verify this is expected and staged to avoid operational disruption.
DBX-CRED-NEW🟡 mediumStorage credential created. This grants cloud storage access (e.g., IAM role, service account) to Unity Catalog. Verify the credential is authorized and follows least-privilege principles.
DBX-CRED-OWNER-CHG🟠 highStorage credential ownership transferred. The new owner gains full control over cloud storage access. Verify this transfer is authorized.
DBX-CRED-NAME-CHG🟡 mediumStorage credential renamed. External locations referencing the old name may need to be updated.
DBX-SCHEMA-MGLOC🟡 mediumSchema created with MANAGED LOCATION. Data storage location overrides catalog/metastore default. Verify external location permissions.
DBX-SCHEMA-LOC🟢 lowSchema created with custom LOCATION. Data will be stored at specified path instead of default warehouse directory.
DBX-SCHEMA-OWNER-CHG🟠 highSchema ownership transferred via OWNER TO. New owner gains full control including DROP privileges. Verify authorization.
DBX-SCHEMA-PREDOPT-CHG🟢 lowSchema predictive optimization setting changed. This affects automatic optimization behavior for objects in the schema.
DBX-SCHEMA-COLLAT-CHG🟢 lowSchema default collation changed. New objects in the schema will use the updated collation. Existing objects are not affected.
DBX-SCHEMA-DBPROPS-CHG🟡 mediumSchema DBPROPERTIES modified. Database properties affect schema metadata and may impact behavior.
DBX-CAT-NEW🟢 lowCREATE CATALOG provisions a new Unity Catalog namespace. All schemas, tables, and other objects within will inherit its permissions and default settings.
DBX-CAT-OWNER-CHG🟠 highALTER CATALOG ... OWNER TO transfers full administrative control of the catalog. The new owner gains MANAGE permissions on all objects within. Verify the target principal is authorized.
DBX-CAT-CASCADE-DROP🔴 criticalDROP CATALOG CASCADE destroys the catalog AND all contained schemas, tables, views, and functions. This is an irreversible bulk data-loss operation.
DBX-CAT-DROP🟠 highDROP CATALOG removes a Unity Catalog namespace. The catalog must be empty unless CASCADE is specified. Verify no downstream dependencies exist.
DBX-CAT-TAG-CHG🟡 mediumCatalog-level tags modified. Tags control governance policies (masking, row filters) across all objects in the catalog. Verify tag values are intentional.
DBX-CAT-TAG-RMV🟡 mediumCatalog-level tags removed. Removing tags may disable governance policies (masking, row filtering) that depend on them.
DBX-CAT-PREDOPT-CHG🟢 lowPredictive optimization setting changed on catalog. This affects automatic maintenance operations (OPTIMIZE, VACUUM) for all tables within the catalog.
DBX-VOL-NEW🟢 lowCREATE VOLUME provisions a new Unity Catalog volume for file storage. External volumes reference cloud storage; managed volumes are fully governed by Unity Catalog.
DBX-VOL-OWNER-CHG🟠 highALTER VOLUME ... OWNER TO transfers full administrative control of the volume. The new owner gains MANAGE permissions on the volume and its contents.
DBX-VOL-DROP🟠 highDROP VOLUME removes a Unity Catalog volume. Managed volumes lose stored files after 7 days; external volumes lose only metadata. This cannot be undone.
DBX-VOL-NAME-CHG🟡 mediumALTER VOLUME ... RENAME TO changes the volume name. Existing file paths referencing /Volumes/catalog/schema/old_name will break.
DBX-VOL-TAG-CHG🟢 lowVolume-level tags modified. Tags enable governance classification and policy enforcement on the volume.
DBX-VOL-TAG-RMV🟡 mediumVolume-level tags removed. Removing tags may disable governance policies that depend on them for the volume.
DBX-EXTLOC-NEW🟡 mediumExternal location created. This maps a cloud storage path to a Unity Catalog location with a storage credential. Verify the URL and credential are authorized.
DBX-EXTLOC-URL-CHG🟡 mediumExternal location URL modified. This changes the mapped cloud storage path for the location. Verify the new URL is intended and access boundaries remain correct.
DBX-EXTLOC-CRED-CHG🟠 highExternal location storage credential changed. This alters which cloud principal accesses the storage path. Verify least-privilege access and authorization boundaries.
DBX-EXTLOC-OWNER-CHG🟠 highExternal location ownership transferred. The new owner gains administrative control over the location and its storage mapping. Verify this transfer is authorized.
DBX-EXTLOC-DROP🟠 highExternal location dropped. Unity Catalog objects relying on this location may lose access to underlying cloud storage. Verify dependency impact before dropping.
DBX-CONN-NEW🟡 mediumExternal connection created. This establishes a federated connection to an external data system (e.g., PostgreSQL, MySQL, Snowflake). Verify the connection type, host, and credentials are authorized.
DBX-CONN-DROP🟠 highExternal connection dropped. Foreign catalogs and federated queries depending on this connection will fail. Verify no active resources depend on this connection.
DBX-CONN-OWNER-CHG🟠 highExternal connection ownership transferred. The new owner gains full control over the federated connection and its credentials. Verify this transfer is authorized.
DBX-CONN-NAME-CHG🟡 mediumExternal connection renamed. Foreign catalogs and queries referencing the old connection name may need to be updated.
DBX-CONN-CHG🟡 mediumExternal connection options changed. Connection credentials (host, port, password) have been modified. Verify the new options are correct and authorized.
DBX-CRED-DROP🟠 highStorage credential dropped. External locations and tables depending on this credential will lose access. Verify no active resources depend on this credential.
DBX-FLOW-NEW🟢 lowCREATE FLOW defines a Lakeflow CDC pipeline (AUTO CDC INTO or APPLY CHANGES INTO). Verify keys, sequencing, and SCD mode align with data governance expectations.
DBX-TBL-PROPS-CHG🟡 mediumDelta table properties modified via SET TBLPROPERTIES. Properties like delta.deletedFileRetentionDuration, delta.logRetentionDuration, or delta.appendOnly control data retention, time travel, and mutability. Verify the new values are authorized and won't cause data loss.
DBX-TBL-PROPS-RMV🟠 highDelta table properties removed via UNSET TBLPROPERTIES. Removing properties like delta.deletedFileRetentionDuration or delta.appendOnly resets them to system defaults, which may reduce retention periods or re-enable mutations on append-only tables.
DBX-TBL-CLUSTER-OFF🟠 highCLUSTER BY NONE disables liquid clustering on a Delta table. Newly inserted or updated data will no longer be clustered, degrading query performance over time. OPTIMIZE will no longer recluster data. Verify this is intentional.
DBX-TBL-CLONE-SHALLOW🟡 mediumSHALLOW CLONE created. Shallow clones share underlying data files with the source table — they do not duplicate data. If the source table is VACUUM'd or dropped, the clone may become unreadable. Prefer DEEP CLONE for durable, independent copies.
DBX-TBL-OPT🟢 lowOPTIMIZE compacts small files in a Delta table. May be resource-intensive on large tables — schedule during off-peak hours.
DBX-VACUUM-ZERO🔴 criticalVACUUM RETAIN 0 HOURS. All historical data files will be permanently deleted immediately, destroying time travel capability and breaking any concurrent operations. This is irreversible data loss.
DBX-VACUUM-LOWRET🟠 highVACUUM with retention period below 7 days (168 hours). This may delete data files needed for time travel or concurrent operations, leading to data loss or query failures.
DBX-TBL-RESTORE🟠 highRESTORE reverts a Delta table to a previous version. This is a data-modifying operation that replaces the current table state with a prior snapshot — downstream consumers may see unexpected data.
DBX-MERGE-SCHEMA-EVO🟡 mediumMERGE WITH SCHEMA EVOLUTION enabled. Target Delta table schema may be automatically altered to match source columns. Validate schema-governance controls and downstream compatibility.
DBX-TBL-CACHE🟢 lowCACHE TABLE caches a table or query result in Spark's in-memory cache. This consumes cluster memory and may affect other workloads. Schedule during off-peak hours for large tables.
DBX-TBL-UNCACHE🟢 lowUNCACHE TABLE removes a table from Spark's in-memory cache. Subsequent queries will read from storage, which may increase latency.

Informational (INFO-xxx)

Rule IDRiskDescription
INFO-SHOW-SECURITY-SURFACE⚪ infoSHOW enumerates a security-relevant object class (users, roles, policies, integrations, or secrets). Recorded for audit — metadata enumeration of the security surface can precede targeted access.
INFO-SNW-RESMON-NEW⚪ infoResource monitor created. Compute credit-usage governance object defined for the warehouses it monitors.
INFO-SNW-SEMVIEW-NEW⚪ infoSemantic view created. It is a named model (logical tables, relationships, facts, dimensions, metrics) built over base tables that query and BI tools — including natural-language interfaces — consume. Confirm the base tables it exposes are intended for this surface.
INFO-SNW-CORTEX-SEARCH-NEW⚪ infoCortex search service created. It builds an AI (embedding-backed) search index over the rows produced by a source query, refreshed on a warehouse. The indexed data becomes queryable through a natural-language search surface — confirm the source query and embedding model are intended.
INFO-SNW-APP-NEW⚪ infoNative application installed. It runs a provider's code inside the account under its own application role. Confirm the source and the privileges the application requests are intended.
INFO-SNW-APPPKG-NEW⚪ infoApplication package created. It is the provider-side container that bundles a Native App for distribution. Confirm what is added to it and how it is distributed.
INFO-SNW-LISTING-NEW⚪ infoListing created. It exposes a share or application package to consumers through the Snowflake Marketplace or a data exchange. Confirm what it exposes and to whom.
INFO-SNW-STAGE-PUT⚪ infoPUT uploads a local file to a stage. Confirm the uploaded content is intended — it becomes available to loads and services that read the stage.
INFO-SNW-STAGE-LIST⚪ infoLIST enumerates the files on a stage. Typically reconnaissance/inspection; confirm the access is expected.
INFO-SNW-DMF-NEW⚪ infoData metric function created. A SQL function that measures table data is now defined; it takes effect when attached to a table.
INFO-SNW-DMF-SECURE⚪ infoSecure data metric function created. The function definition is hidden from users without ownership.
INFO-SNW-ACCT-PARAM-CHG⚪ infoAccount-level parameter changed via ALTER ACCOUNT. Account-wide settings affect every user and object — verify the change is intended.
INFO-SNW-PIPE-ERRINT⚪ infoError integration configured on pipe. Error notifications will be sent.
INFO-SNW-TAG-CREATE⚪ infoTag created. New governance classification label available for assignment.
INFO-SNW-TAG-UNDROP⚪ infoTag recovered using UNDROP. Previously dropped tag has been restored.
INFO-SNW-FILEFORMAT-CREATE⚪ infoFile format created. Defines how staged data files are parsed on load; referenced by COPY and external tables.
INFO-SNW-SESSION-PARAM-SET⚪ infoSession parameter(s) set. The change applies to the current session only and is not persisted.
INFO-SNW-SESSION-PARAM-UNSET⚪ infoSession parameter(s) reset to default for the current session.
INFO-MSSQL-EXT-DATA-SOURCE⚪ infoExternal data source registered. This declares a federated endpoint (Hadoop, blob storage, remote database, or sharded database) that queries can reach. Positive governance signal — documents an external connectivity surface.
INFO-MSSQL-EXT-DATA-SOURCE-ALTER⚪ infoExternal data source reconfigured. An ALTER changes where an existing federated endpoint points or which credential it uses — a redirect of a connectivity surface that downstream queries already trust. Verify the new location and credential are authorized.
INFO-UDF-SECURE-ADD⚪ infoFunction secured. Function body is now hidden from users without ownership.
INFO-PROC-SECURE-ADD⚪ infoProcedure secured. Procedure body is now hidden from users without ownership.
INFO-SNW-WH-RESMON⚪ infoResource monitor assigned to warehouse. Cost governance in place.
INFO-TBL-CLONE⚪ infoTable cloned. CLONE creates a copy of a table. In Snowflake, clones are zero-copy and share storage until modified. In Databricks, SHALLOW clones share data files while DEEP clones duplicate them.
INFO-SNW-HYBRID-TABLE⚪ infoHybrid table created. Hybrid (Unistore) tables are row-oriented OLTP storage with enforced primary-key, unique, and foreign-key constraints, distinct from standard analytical tables.
INFO-DBX-TBL-HIST⚪ infoDESCRIBE HISTORY retrieves the provenance log for a Delta table. This is a read-only audit operation — no data is modified.
INFO-DBX-TBL-REPAIR⚪ infoREPAIR TABLE (MSCK REPAIR TABLE) updates the Hive metastore partition metadata for a partitioned table. This is a metadata maintenance operation; it does not rewrite table data.
INFO-DBX-TBL-CLUSTER-CFG⚪ infoLiquid clustering configured on Delta table. Run OPTIMIZE to apply clustering to existing data.
INFO-DBX-TBL-CACHE-LAZY⚪ infoCACHE LAZY TABLE registers a table for deferred caching — data is only cached on first access. Lower impact than eager CACHE TABLE.
INFO-Q-PRED-TEMPORAL⚪ infoTemporal predicate detected using CURRENT_DATE/CURRENT_TIMESTAMP. Results change daily, affecting cache hit rates.
INFO-MSSQL-HINT⚪ infoT-SQL table hint detected. Table hints override default locking and query plan behavior. Ensure hints are intentional and reviewed during code changes.
INFO-MSSQL-IDENTITY-INSERT-OFF⚪ infoSET IDENTITY_INSERT OFF restores normal IDENTITY column behavior. Positive signal: auto-increment protection re-enabled.
INFO-MSSQL-ISOLATION-LEVEL⚪ infoTransaction isolation level set for the session. The isolation level governs concurrency and consistency (dirty reads, phantom reads, locking) for subsequent statements.
INFO-MSSQL-BACKUP⚪ infoDatabase or transaction-log backup taken. A backup is a full copy of the data at rest; ensure its destination is access-controlled and the backup is encrypted.
INFO-MSSQL-RESTORE⚪ infoDatabase or transaction-log restore performed. A restore overwrites the target with data from a backup; ensure the source is trusted and the operation is intended.
INFO-MSSQL-DBCC⚪ infoDBCC (database console command) executed. The DBCC family spans integrity checks, maintenance, performance tuning and undocumented internals; confirm the command is appropriate for this environment.
INFO-MSSQL-KEY-MANAGEMENT⚪ infoA T-SQL encryption-key context switch (OPEN/CLOSE { MASTER KEY | SYMMETRIC KEY | ALL SYMMETRIC KEYS }) was executed. Key activation changes which encrypted data is accessible in the session; confirm it is scoped and closed as intended.
INFO-MSSQL-SECURITY-POLICY⚪ infoA T-SQL row-level-security policy was created or altered. Security policies bind filter predicates (which rows reads return) and block predicates (which rows writes may touch) to tables; confirm the change matches the intended access control.
INFO-MSSQL-KEY-BACKUP⚪ infoT-SQL key material (master key, service master key, certificate, or asymmetric key) was backed up to or restored from a file. Key-material files cross the filesystem boundary and must be handled as secrets; confirm the operation and the file's storage location are intended.
INFO-MSSQL-CLR-ASSEMBLY⚪ infoA T-SQL CLR assembly was created or altered. CLR assemblies run .NET code inside the SQL Server process; confirm the assembly is trusted and its permission set is the minimum required.
INFO-MSSQL-SET-OPTION⚪ infoT-SQL session option changed via SET. Session options (NOCOUNT, ANSI_NULLS, XACT_ABORT, etc.) affect query behavior and error handling for the current session.
INFO-MSSQL-EXTMDL-DROP🟢 lowDROP EXTERNAL MODEL removes an AI endpoint registration. Positive signal: reduces external attack surface. Verify no dependent queries rely on this model.
INFO-PG-DOMAIN-NEW⚪ infoDomain created. Positive governance signal — custom type constraints are being defined.
INFO-PG-DOMAIN-CONSTR-ADD⚪ infoConstraint added to domain. Positive governance signal — data validation is being strengthened.
INFO-PG-RLS-NEW⚪ infoRow-level security policy created. Positive governance signal — data access is being restricted at the row level.
INFO-PG-RLS-TABLE-ENABLE⚪ infoALTER TABLE ... ENABLE ROW LEVEL SECURITY. Positive governance signal — row-level security is now enforced for non-owner roles on the table.
INFO-PG-RLS-TABLE-FORCE⚪ infoALTER TABLE ... FORCE ROW LEVEL SECURITY. Positive governance signal — row-level security is now enforced for the table owner as well.
INFO-PG-FDW-SERVER⚪ infoForeign server registered. This declares a federated endpoint reached through a foreign-data wrapper. Positive governance signal — documents an external connectivity surface.
INFO-PG-FDW-SERVER-ALTER⚪ infoForeign server reconfigured. This modifies a federated endpoint reached through a foreign-data wrapper (its version, options, owner, or name). Positive governance signal — documents a change to an external connectivity surface.
INFO-MSSQL-SERVER-CONFIG⚪ infoSQL Server instance configuration changed via ALTER SERVER CONFIGURATION. This is an engine-level reconfiguration. Positive governance signal — documents a change to server-instance settings.
INFO-PG-FDW-USER-MAPPING⚪ infoUser mapping created or altered. This attaches per-role credentials for a foreign server, enabling federated access. Positive governance signal — documents a credential binding to an external system.
INFO-PG-FDW-USER-MAPPING-DROP⚪ infoUser mapping dropped. The per-role credentials for the foreign server are removed; queries that relied on them lose federated access. Positive governance signal — documents removal of an external credential binding.
INFO-PG-FDW-FOREIGN-TABLE⚪ infoForeign table created. This local table is a handle for a remote relation on a foreign server; queries against it cross the instance boundary to read (or write) external data. Positive governance signal — documents a federated-data surface.
INFO-PG-FDW-IMPORT-FOREIGN-SCHEMA⚪ infoForeign schema imported. Remote tables are registered as local foreign tables in bulk, enabling federated reads (or writes) across the instance boundary. Positive governance signal — documents a federated-data surface.
INFO-PG-IDX-NEW⚪ infoCREATE INDEX adds an index. Positive governance signal — improves query performance.
INFO-SYNONYM-NEW⚪ infoCREATE SYNONYM adds a named alias for a base object. Queries through the alias resolve to the referenced object; confirm the target is the intended one.
INFO-PG-TRIG-ON⚪ infoALTER TABLE ... ENABLE TRIGGER restores trigger firing. Positive signal: security/audit enforcement re-activated.
INFO-SEQ-NEW⚪ infoCREATE SEQUENCE defines a new sequence generator.
INFO-SEQ-CHG⚪ infoALTER SEQUENCE modifies a sequence generator. Changes to INCREMENT, RESTART, or ownership may affect dependent tables.
INFO-PG-TYPE-NEW⚪ infoCREATE TYPE defines a new composite, enum, or range type.
INFO-PG-TYPE-CHG⚪ infoALTER TYPE modifies a user-defined type (add/rename values, change owner, etc.).
INFO-MYSQL-LOAD-DATA-INFILE🟢 lowLOAD DATA INFILE bulk-loads a file into a table. Without LOCAL the path is read from the database server's own filesystem (requires the FILE privilege) — a data-ingestion surface that can read server-side files. Verify the source path and the loading role's privilege are authorized.
INFO-MYSQL-EVENT⚪ infoCREATE EVENT defines a scheduled SQL job. Its DO body runs on the event scheduler under the definer's privileges. Verify the schedule and body are intended; the body's statements are analyzed independently.
INFO-MYSQL-EVENT-ALTER⚪ infoALTER EVENT reconfigures a scheduled job (its schedule, enable state, name, or body). Verify the change is intended.
INFO-MYSQL-TRIGGER⚪ infoCREATE TRIGGER defines code that runs automatically on every matching row event (INSERT / UPDATE / DELETE) on the target table, under the definer's privileges. A trigger is an automatic-execution and persistence surface — verify its body is intended. The body's statements are analyzed independently.
INFO-DB-NEW⚪ infoDatabase created. New database provisioned.
INFO-SCHEMA-NEW⚪ infoSchema created. New schema provisioned.
INFO-TBL-UNDROP⚪ infoTable recovered using UNDROP. Previously dropped table has been restored.
INFO-TYPE-UNDROP⚪ infoUNDROP TYPE recovers a previously dropped user-defined type from Snowflake Time Travel.
INFO-DB-UNDROP⚪ infoDatabase recovered using UNDROP. Previously dropped database has been restored.
INFO-SCHEMA-UNDROP⚪ infoSchema recovered using UNDROP. Previously dropped schema has been restored.
INFO-PG-MAINT-VACUUM⚪ infoVACUUM reclaims storage and updates statistics. Routine maintenance operation.
INFO-PG-MAINT-ANALYZE⚪ infoANALYZE updates table statistics for the query planner. Routine maintenance operation.
INFO-PG-MAINT-CLUSTER⚪ infoCLUSTER reorders table data according to an index. May cause brief lock on the table.
INFO-PG-NOTIFY-SUB⚪ infoLISTEN subscribes to a notification channel.
INFO-PG-NOTIFY-SEND⚪ infoNOTIFY sends a notification on a channel.
INFO-PG-NOTIFY-UNSUB⚪ infoUNLISTEN unsubscribes from a notification channel.
INFO-PG-AGG-NEW⚪ infoCREATE AGGREGATE defines a new aggregate function.
INFO-PG-OP-NEW⚪ infoCREATE OPERATOR defines a new operator.
INFO-COMMENT-CHG⚪ infoCOMMENT ON modifies object metadata. Positive governance signal — improves documentation.
INFO-DBX-CAT-COMMENT-CHG⚪ infoCOMMENT ON CATALOG modifies Unity Catalog metadata. Positive governance signal — improves catalog documentation and discoverability.
INFO-DBX-VOL-COMMENT-CHG⚪ infoCOMMENT ON VOLUME modifies Unity Catalog volume metadata. Positive governance signal — improves storage documentation.
INFO-DBX-CONN-COMMENT-CHG⚪ infoCOMMENT ON CONNECTION modifies Unity Catalog connection metadata. Positive governance signal — documents external data source purpose and ownership.
INFO-MSSQL-EXEC-PROC⚪ infoStored procedure executed via EXEC. Audit trail: verify the procedure exists and caller has EXECUTE permission.
INFO-MSSQL-SETUSER⚪ infoA T-SQL SETUSER statement was executed. SETUSER changes the database security context (or, with no argument, reverts it); it is deprecated in favor of EXECUTE AS / REVERT.
INFO-MSSQL-SERVICE-MASTER-KEY⚪ infoAn ALTER SERVICE MASTER KEY statement was executed. The service master key is the root of the SQL Server encryption hierarchy; confirm any re-key or service-account change is intended and that the key is backed up.
INFO-PG-DEFAULT-PRIVILEGES⚪ infoAn ALTER DEFAULT PRIVILEGES statement was executed. This sets the privileges automatically applied to objects created in the future, a standing policy rather than a one-time grant; confirm the default is intended.
INFO-MSSQL-CRYPTO-NEW⚪ infoAn encryption-hierarchy object (master key, symmetric/asymmetric key, or certificate) was created. Positive governance signal — encryption or signing capability is being provisioned. Verify the key/certificate is backed up.
INFO-MSSQL-AUDIT-NEW⚪ infoA SQL Server audit or audit specification was created. Positive governance signal — activity capture is being configured.
INFO-MSSQL-DB-ENCRYPTION-ON⚪ infoALTER DATABASE ... SET ENCRYPTION ON enables transparent data encryption. Positive governance signal — data at rest is being protected.
INFO-MSSQL-VECIDX-NEW⚪ infoCREATE VECTOR INDEX adds a DiskANN vector similarity index. This enables approximate nearest-neighbor search on embedding columns. Review: metric type (cosine/dot/euclidean), MAXDOP setting, and storage impact on the target filegroup.

Other

Rule IDRiskDescription
SHOW-GRANTS-PRIV-ROLE-RECON🟢 lowSHOW GRANTS enumerates the privileges or members of a privileged system role. Mapping who holds — or what is held by — an admin role is a common precursor to privilege escalation; confirm the caller is authorized.
SHOW-GRANTS-ON-ACCOUNT-RECON🟢 lowSHOW GRANTS ON ACCOUNT enumerates every privilege granted at the account level — a broad inventory of account-wide access. Confirm the caller is authorized to enumerate account grants.
PRIV-ON-FUTURE🟡 mediumON FUTURE grant expands to objects not yet created.
MSSQL-GRT-CONTROL-SERVER🔴 criticalGRANT CONTROL SERVER detected. This confers full administrative control over the entire SQL Server instance — equivalent to sysadmin membership. Require explicit approval.
MSSQL-GRT-IMPERSONATE-ANY-LOGIN🔴 criticalGRANT IMPERSONATE ANY LOGIN detected. The grantee can assume the identity of any server login, enabling full privilege escalation. Require explicit approval.
MSSQL-GRT-IMPERSONATE🟠 highGRANT IMPERSONATE detected. The grantee can execute statements as another principal, which can bypass intended access boundaries. Verify scope and approval.
MSSQL-GRT-SERVER-ADMIN🟠 highGRANT of a server-administration permission detected (ALTER ANY LOGIN / SERVER ROLE / CREDENTIAL / DATABASE, or ALTER SERVER STATE). These confer broad instance-level control. Verify least-privilege scope and approval.
MSSQL-GRT-UNSAFE-ASSEMBLY🟠 highGRANT of UNSAFE ASSEMBLY or EXTERNAL ACCESS ASSEMBLY detected. This permits loading CLR assemblies that can run arbitrary native or OS-level code. Require explicit approval.
MSSQL-GRT-TAKE-OWNERSHIP🟠 highGRANT TAKE OWNERSHIP detected. The grantee can seize ownership of the securable and thereby gain full control over it. Verify approval.
MSSQL-GRT-CONTROL-DATABASE🟠 highGRANT CONTROL ON DATABASE detected. CONTROL at the database level grants all permissions on the database and every object in it — effectively db_owner. Verify scope and approval.
MSSQL-GRT-CONTROL-SCHEMA🟡 mediumGRANT CONTROL ON SCHEMA detected. CONTROL at the schema level grants all permissions on every object in the schema. Verify scope.
MSSQL-GRT-VIEW-DEFINITION-STATE🟡 mediumGRANT of a broad metadata-visibility permission detected (VIEW ANY DATABASE / VIEW SERVER STATE / VIEW ANY DEFINITION). This exposes instance-wide metadata or runtime state. Verify intent.
MSSQL-GRT-TRACE-BULK🟡 mediumGRANT ALTER TRACE or ADMINISTER BULK OPERATIONS detected. These enable instance-level tracing or bulk data loading that can bypass intended access controls. Verify intent.
MSSQL-GRT-TO-GUEST🟡 mediumGRANT to the guest user detected. The guest account is available to any login without an explicit database user; granting it permissions broadens access unexpectedly. Verify intent.
MYSQL-INTO-OUTFILE🟠 highSELECT writes its result set to a file on the database server (INTO OUTFILE / INTO DUMPFILE). This requires the FILE privilege, bypasses result-set access controls, and is a common data-exfiltration and file-drop channel; the written file is owned by the server process and readable outside the database. Export through an audited pipeline (mysqldump, replication, or an ETL job) instead of server-side file writes.
MSSQL-OPENROWSET-INLINE-CRED🔴 criticalOPENROWSET called with an inline connection string containing credentials. T-SQL OPENROWSET('provider', 'Server=...;PWD=...', ...) exposes the password in the SQL text and reaches an arbitrary external server. Use a linked-server with stored credentials, or a SQL Server credential object, not inline connection strings.
MSSQL-OPENDATASOURCE-INLINE-CRED🔴 criticalOPENDATASOURCE called with an inline connection string containing credentials. T-SQL OPENDATASOURCE('provider', 'Data Source=...;Password=...').db.schema.table is ad-hoc remote access that exposes the password in the SQL text and reaches an arbitrary external server. Use a linked server with stored credentials, or a SQL Server credential object, not inline connection strings.
MSSQL-EXT-DATA-SOURCE-CREDENTIAL🟡 mediumExternal data source registered or reconfigured with a stored credential. Queries through it reach an external endpoint authenticated by a persisted credential; verify the endpoint and credential are authorized and least-privilege.
MSSQL-EXT-DATA-SOURCE-PUBLIC-ENDPOINT🟡 mediumExternal data source points at a public / offsite endpoint. Data read or written through it crosses the instance boundary to internet-reachable storage; verify the destination is authorized.
RS-DIST-ALL🟡 mediumDISTSTYLE ALL replicates the entire table to every compute node. Storage and load cost scale with cluster size; it is intended only for small, slowly-changing dimension tables. Verify the table is small enough to justify full replication.
RS-BACKUP-NO🟠 highBACKUP NO excludes this table from automated and manual cluster snapshots. Its data is NOT recoverable from a snapshot restore. Confirm the table is genuinely transient (e.g. staging/scratch) before disabling backups.
RS-SORTKEY-INTERLEAVED⚪ infoINTERLEAVED SORTKEY weights every sort column equally but carries higher VACUUM REINDEX maintenance cost and degrades as the table grows. Prefer COMPOUND SORTKEY unless queries filter on many sort columns independently.
RS-DATASHARE-NEW🟢 lowDatashare created (Redshift cross-account / cross-cluster data-sharing object). Objects added to it become queryable by consumer namespaces or AWS accounts; review what gets shared.
RS-DATASHARE-PUBLIC🔴 criticalDatashare set PUBLICACCESSIBLE TRUE — its objects are shareable with ANY AWS account, not just authorized consumer namespaces. This is a broad cross-account data-exposure surface. Confirm public accessibility is intended.
RS-DATASHARE-OBJ-ADD🟢 lowObject added to a datashare — it becomes queryable by the datashare's consumer accounts/namespaces. Verify the table or schema is authorized for cross-account sharing.
RS-DATASHARE-INCLUDENEW🟡 mediumDatashare set to auto-include newly created objects (INCLUDENEW) for a schema — future tables/views are shared with consumers automatically, with no per-object review. Verify implicit sharing of future objects is intended.
CAT-TBL-UNKNOWN🟡 mediumQuery references a table that is not present in the attached catalog. The table may be misspelled, dropped, or in a schema/database the catalog snapshot does not cover.
CAT-COL-UNKNOWN🟡 mediumQuery references a column that is not declared on its table per the attached catalog. The column may be misspelled, dropped, or added in a schema the catalog snapshot does not cover.
CAT-COL-AMBIGUOUS🟡 mediumQuery contains an unqualified column reference that resolves to two or more in-scope tables per the attached catalog. Qualify the column with its source table to avoid surprising binding behavior.
MSSQL-HINT-DIRTYREAD🟠 highTable hint NOLOCK or READUNCOMMITTED allows reading uncommitted data. Queries may return phantom rows, partially-written rows, or miss rows entirely. This is NOT a free performance optimization.
MSSQL-HINT-XLOCK🟡 mediumTable hint TABLOCKX or XLOCK requests exclusive locks, blocking all concurrent readers and writers. This can cause severe contention and deadlocks in production workloads.
MSSQL-HINT-INDEX🟡 mediumINDEX hint forces a specific index, overriding the query optimizer. The forced index may become stale as data distribution changes, or may be dropped/renamed, causing query failures.
MSSQL-HINT-FORCESCAN🟡 mediumFORCESCAN forces a full table or index scan, bypassing index seeks. Unless intentional for analytics workloads, this typically degrades performance on large tables.
MSSQL-HINT-FORCESEEK🟢 lowFORCESEEK forces the optimizer to use an index seek. While generally safe, this overrides the optimizer's cost-based decision and may degrade performance when a scan would be more efficient.
MSSQL-BULK-INSERT🟡 mediumBULK INSERT loading data from external file. External file access requires ADMINISTER BULK OPERATIONS permission. Verify file path, format options, and data validation.
MSSQL-EXTMDL-NEW🟠 highCREATE EXTERNAL MODEL registers an external AI endpoint (e.g., Azure OpenAI). Data sent to this model leaves the SQL Server boundary. Review: endpoint URL, credential scope, and data classification of columns that will be embedded or sent for inference.
MSSQL-EXTMDL-RMT🟠 highExternal AI model establishes a remote connection to an external service. Verify the endpoint URL is trusted, the credential has minimal required scope, and network egress rules permit this traffic.
MSSQL-EXTMDL-CHG🟡 mediumALTER EXTERNAL MODEL modifies an AI endpoint configuration. This could change the target service URL, credentials, or model name. Verify the new configuration doesn't expand data exposure.
MSSQL-LOGIN-NEW🟠 highCREATE LOGIN adds a new server-level authentication principal. This grants the ability to connect to the SQL Server instance. Review: authentication method (password, certificate, Windows, or external provider), password policy, and intended access scope.
MSSQL-LOGIN-CHECK-POLICY-OFF🟠 highCHECK_POLICY = OFF exempts this SQL login from the Windows password policy: complexity requirements and account-lockout rules no longer apply, so weak passwords are accepted and repeated sign-in attempts are never locked out. Keep policy enforcement on, or use integrated authentication for service accounts.
MSSQL-LOGIN-CHECK-EXPIRATION-OFF🟢 lowCHECK_EXPIRATION = OFF disables password expiration for this SQL login, so its password is never required to change. Review against your credential-rotation policy.
MSSQL-USER-NEW🟠 highCREATE USER adds a new database-level authorization principal. This user can be granted permissions on database objects. Review: whether the user maps to a login (FOR LOGIN), is contained (WITH PASSWORD), or has no login (WITHOUT LOGIN for service accounts).
MSSQL-IDENTITY-INSERT-ON🟠 highSET IDENTITY_INSERT ON allows explicit values in IDENTITY columns, bypassing auto-increment. This can cause key collisions, break referential integrity, and indicates manual data manipulation. Ensure this is intentional and temporary.
MSSQL-ISOLATION-READ-UNCOMMITTED🟡 mediumSET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED permits dirty reads — the session can read uncommitted, possibly-rolled-back data (equivalent to NOLOCK on every read). Acceptable for some reporting/analytics, but a correctness risk in transactional code. Confirm dirty reads are acceptable here.
MSSQL-BACKUP-TO-URL🟡 mediumBACKUP ... TO URL writes a database or log backup to an offsite object store (Azure blob). The backup leaves the controlled environment and the URL commonly embeds a SAS credential. Confirm the destination is authorized, access-controlled, and that the backup is encrypted.
MSSQL-RESTORE-FROM-URL🟡 mediumRESTORE ... FROM URL reads a database or log backup from an offsite object store (Azure blob). The restored data originates outside the controlled environment and the URL commonly embeds a SAS credential. Confirm the source is trusted and authorized.
MSSQL-RESTORE-REPLACE🟡 mediumRESTORE ... WITH REPLACE force-overwrites an existing database, discarding its current contents even when recovery would normally refuse. Confirm the target database is meant to be replaced.
MSSQL-DBCC-WRITEPAGE🟠 highDBCC WRITEPAGE writes raw bytes directly to a data page, bypassing the storage engine and all integrity checks. It can silently corrupt or tamper with table data and is unsupported outside disaster recovery. This has no legitimate place in application or migration scripts.
MSSQL-DBCC-SENSITIVE🟡 mediumDBCC command changes global engine behavior, reclaims storage, or clears server caches. These affect availability and observability beyond the current session (e.g. trace flags alter engine behavior server-wide; SHRINK fragments data files; cache flushes degrade production performance). Confirm the command is intended for this environment.
MSSQL-KEY-OPEN-INLINE-PASSWORD🟠 highAn encryption key is opened with a hardcoded password embedded in the statement (OPEN ... DECRYPTION BY PASSWORD). The password sits in source/version control in plaintext, defeating the key it protects; anyone with the script can decrypt the data. Supply the password out of band, not as a literal.
MSSQL-OPEN-MASTER-KEY🟡 mediumThe database master key (DMK) is opened in this session. The DMK decrypts the certificates and keys protecting sensitive data; activating it widens the window in which that data is accessible. Confirm the surrounding code closes the key promptly and runs with least privilege.
MSSQL-RLS-POLICY-DISABLED🟠 highAn existing row-level-security policy is being turned off (ALTER SECURITY POLICY ... WITH (STATE = OFF)). While the policy is off it enforces nothing: every row it was filtering becomes visible, and the writes its block predicates were restricting are allowed. Disabling row-level security removes an active data-access control.
MSSQL-RLS-POLICY-CREATED-DISABLED🟡 mediumA row-level-security policy is created in a disabled state — STATE = OFF, or no STATE clause (which SQL Server defaults to OFF). The predicates are defined but enforce nothing until the policy is explicitly enabled, so the rows it is meant to protect are exposed in the meantime. Confirm the policy is intended to ship disabled.
MSSQL-MASTER-KEY-EXPORT🟠 highA database or service master key is backed up to a file (BACKUP MASTER KEY / SERVICE MASTER KEY). This exports the root of the SQL Server encryption hierarchy: anyone with the resulting file (and its password) can decrypt everything the key protects. Treat the exported file as a critical secret and confirm it is not written to a shared or source-controlled location.
MSSQL-MASTER-KEY-RESTORE🟠 highA database or service master key is restored from a file (RESTORE MASTER KEY / SERVICE MASTER KEY). This re-keys the instance or database from external key material; a restore from an untrusted file substitutes the root of the encryption hierarchy. Confirm the source file is trusted and the operation is intended.
MSSQL-KEY-BACKUP-INLINE-PASSWORD🟠 highKey material is backed up or restored using a hardcoded password (BACKUP/RESTORE ... { ENCRYPTION | DECRYPTION } BY PASSWORD = '...'). The password that protects the exported key — or unlocks the imported one — sits in the script in plaintext, so anyone with the file and the script can recover the key. Supply the password out of band, not as a literal.
MSSQL-CLR-ASSEMBLY-UNSAFE🟠 highA CLR assembly is registered with PERMISSION_SET = UNSAFE. UNSAFE grants the .NET code full trust inside the SQL Server process — native calls, P/Invoke, and arbitrary I/O — which is an arbitrary-code-execution and persistence surface equivalent to running native code as the service account. UNSAFE assemblies have almost no legitimate place in application code; confirm this is a vetted, signed assembly and not attacker-introduced.
MSSQL-CLR-ASSEMBLY-EXTERNAL-ACCESS🟡 mediumA CLR assembly is registered with PERMISSION_SET = EXTERNAL_ACCESS. The .NET code may reach the filesystem, network, registry, and environment outside the database, under the SQL Server service account. Confirm the assembly is trusted and requires that access.
MSSQL-SIGNATURE-INLINE-PASSWORD🟠 highA module is signed using a hardcoded password (ADD SIGNATURE ... WITH PASSWORD = '...'). The password unlocks the signing certificate's or asymmetric key's private key and sits in the script in plaintext, so anyone with the script can re-sign modules as that signer — and thus mint the elevated privileges the signer grants. Supply the password out of band, not as a literal.
MSSQL-MODULE-SIGNATURE-ADDED🟡 mediumA module is signed by a certificate or asymmetric key (ADD SIGNATURE / ADD COUNTER SIGNATURE). A signed module executes with the permissions granted to the principal derived from the signer, regardless of who calls it — a privilege-delegation mechanism that grants the module abilities its callers do not have. Confirm the signer's grants are intended and minimal, and that the module's code is trusted.
MSSQL-LOGIN-EXT🟠 highCREATE LOGIN FROM EXTERNAL PROVIDER configures authentication via an external identity provider (e.g., Microsoft Entra ID). Verify: the OBJECT_ID maps to the correct external identity, the TYPE (E=user, X=group/app) is intentional, and the external provider trust relationship is established.
MSSQL-USER-EXT🟠 highCREATE USER FROM EXTERNAL PROVIDER maps a database user to an external identity (Microsoft Entra ID). Verify: the OBJECT_ID matches the intended external principal, and the external provider configuration is correct.
MSSQL-SERVER-CONFIG-SENSITIVE🟡 mediumServer-instance configuration changed in a subsystem with a filesystem or high-availability surface (diagnostics log path, buffer-pool extension file, HADR/failover cluster context). These touch where the engine writes data or how it fails over — verify the change is authorized and the target path/endpoint is trusted.
SYNONYM-REMOTE-REFERENT🟡 mediumSynonym aliases a four-part server.database.schema.object name — it points at an object on a linked or remote server, so reads and writes through the alias cross a server boundary. Confirm the linked-server reference is intended and authorized.
ROLE-NEW🟡 mediumCREATE ROLE/USER adds a new database principal. Review granted privileges, login capability, and role membership to prevent privilege creep.
ROLE-CHG🟠 highALTER on a database principal (role, user, or login) modifies its attributes. Changes to privileges, login capability, or role membership can significantly affect security posture — verify the change is intended and authorized.
ROLE-DROP🟠 highDROP ROLE/USER removes a database principal. Objects owned by the principal and grants that depend on it may become inaccessible; reassign ownership before dropping.
SEQ-DROP🟢 lowDROP SEQUENCE removes a sequence generator. Columns using this sequence for defaults will break.
SEQ-CASCADE-DROP🟡 mediumDROP SEQUENCE ... CASCADE removes the sequence and all dependent objects (columns with DEFAULT nextval, etc.).
SEQ-REPLACE🟢 lowCREATE OR REPLACE SEQUENCE resets the generator to its START value. New rows restart numbering while existing rows keep their IDs — risking duplicate or colliding key values in dependent tables.
MYSQL-LOAD-DATA-LOCAL-INFILE🟡 mediumLOAD DATA LOCAL INFILE reads a file from the client host and streams it to the server. A compromised or malicious server can coerce the client into disclosing arbitrary readable files, and the feature is disabled by default in hardened configurations. Confirm LOCAL is required and the client/server are trusted.
MYSQL-LOAD-DATA-EXTERNAL-STORAGE🟡 mediumLOAD DATA INFILE ingests from an external cloud-storage URI (S3 / GCS / Azure). Data crosses the instance boundary on load — verify the source bucket's integrity and access controls.
MYSQL-EVENT-RECURRING🟢 lowCREATE EVENT defines a recurring scheduled job (ON SCHEDULE EVERY …) that runs its DO body automatically on an interval, with no operator in the loop. A recurring event is a persistence and automation surface — verify the schedule, the definer it runs as, and the body are authorized. The body's own statements are analyzed separately.
MYSQL-EVENT-BODY-CHANGED🟢 lowALTER EVENT … DO rebinds the scheduled job's body to new SQL. The statements that run on schedule have changed — confirm the new body is authorized. The new body is analyzed separately.
MYSQL-TRIGGER-DEFINER🟢 lowThe trigger names an explicit DEFINER. Its body runs with that account's privileges on every matching row event, regardless of which user performs the write — a privilege-delegation and persistence surface (a trigger that re-grants privileges or exfiltrates on write executes unattended). Confirm the definer account's privilege level is appropriate. (Pin privileged-account names in policy via ddl.create_trigger.definer.user to raise the severity.)
MYSQL-EVENT-DEFINER🟢 lowThe event names an explicit DEFINER. Its scheduled body runs with that account's privileges regardless of who created or triggers it, so the event is a privilege-delegation surface — a body that the definer is entitled to run executes unattended on schedule. Confirm the definer account's privilege level is appropriate for the body. (Pin the privileged-account names in policy via ddl.event.definer.user to raise the severity for sensitive definers.)
MYSQL-PROC-DEFINER🟢 lowThe stored procedure names an explicit DEFINER. Its body runs with that account's privileges regardless of which user calls it (MySQL SQL SECURITY DEFINER) — a privilege-delegation surface: a caller with EXECUTE can perform actions the definer is entitled to but they are not. Confirm the definer account's privilege level is appropriate for the body. (Pin privileged-account names in policy via ddl.procedure.definer.user to raise the severity.)
MYSQL-FUNC-DEFINER🟢 lowThe stored function names an explicit DEFINER. Its body runs with that account's privileges regardless of which user invokes it (MySQL SQL SECURITY DEFINER) — a privilege-delegation surface: any query that calls the function executes the body under the definer's rights. Confirm the definer account's privilege level is appropriate for the body. (Pin privileged-account names in policy via ddl.function.definer.user to raise the severity.)
MYSQL-VIEW-DEFINER🟢 lowThe view names an explicit DEFINER. Under SQL SECURITY DEFINER (the MySQL default), the view's query runs with that account's privileges regardless of who selects from it, so the view can expose rows the caller could not read directly — a privilege-delegation surface. Confirm the definer account's privilege level is appropriate. (Pin privileged-account names in policy via ddl.view.definer.user to raise the severity.)
MYSQL-VIEW-SQL-SECURITY-DEFINER🟢 lowThe view explicitly declares SQL SECURITY DEFINER: its query runs with the definer account's privileges, not the caller's, so any user with SELECT on the view reads through the definer's rights and can see data they are not otherwise authorized for. Prefer SQL SECURITY INVOKER unless definer-rights access is intended and the definer is suitably constrained.
MSSQL-POLYBASE-EXTERNAL-TABLE🟢 lowPolyBase external table bound to an external data source. Querying it reaches data outside this database — a remote relational store, Hadoop, or blob/cloud storage — across the instance boundary through the named DATA_SOURCE. Verify the data source and its credentials are authorized.
SPECTRUM-EXTDATA-NEW⚪ infoRedshift Spectrum external schema registers an external data source (Glue Data Catalog / Hive Metastore / federated database). Data queried through it crosses the cluster boundary; verify the IAM role is least-privilege and the external database/location is authorized.
TRIG-CHG🟡 mediumTrigger altered. Review the updated trigger configuration.
TRIG-DROP🟠 highTrigger dropped. Automated logic previously enforced by this trigger will no longer execute. Verify data integrity.
TRIG-NEW🟡 mediumTrigger created. Triggers execute automatically and can have significant performance and security implications. Review the trigger function.
MSSQL-XP-CMDSHELL🔴 criticalEXEC xp_cmdshell invokes the OS shell from SQL Server. xp_cmdshell runs arbitrary shell commands with the SQL Server service account's privileges (often LocalSystem or a domain account) and is a primary lateral-movement vector after a SQL injection compromise. Disable xp_cmdshell unless absolutely required; if required, restrict to sysadmin only.
MSSQL-SPCONFIG-XPCMDSHELL🔴 criticalsp_configure invoked with 'xp_cmdshell' option. This is the prerequisite to enabling xp_cmdshell at the server level. After this call + RECONFIGURE, EXEC xp_cmdshell can run OS commands. Verify intent and audit the surrounding context.
MSSQL-LINKEDSRV-ADD🟠 highsp_addlinkedserver registers a linked server. A linked server is a persistent connection to a remote data source that distributed queries (four-part names, OPENQUERY, EXEC ... AT) run against. It widens the data-exfiltration and lateral-movement surface and, combined with sp_addlinkedsrvlogin credential mappings, can let any caller reach the remote server. Review the provider, data source, and who can use it.
MSSQL-LINKEDSRV-LOGIN🟠 highsp_addlinkedsrvlogin maps a local login to a remote login on a linked server. This stores cross-server credentials and governs who can execute distributed queries against the remote source. Verify the mapping (especially @useself = 'False' with an explicit remote login) and that the remote account is least-privilege.
MSSQL-LINKEDSRV-LOGIN-CRED🔴 criticalsp_addlinkedsrvlogin called with a literal @rmtpassword. A remote-server password is hard-coded in the SQL text, exposing it to anyone who can read the script, query history, or audit logs, and it reaches an external server. Use integrated security (@useself = 'True') or a credential object instead of an inline password.
MSSQL-LINKEDSRV-READ🟡 mediumDistributed query against a linked server. A four-part name (server.database.schema.object) reads or writes data on a remote SQL Server over a linked-server connection — data crosses a server boundary and depends on the linked server's stored credentials and trust. Verify the cross-server access is intended and the remote account is least-privilege.
MSSQL-AGENTJOB-CMDEXEC🔴 criticalSQL Agent job step created with @subsystem = 'CmdExec'. A CmdExec step runs an arbitrary operating-system command under the SQL Server Agent service account (or a proxy), giving SQL-level access an OS-command channel that bypasses xp_cmdshell controls. It is a primary persistence and lateral-movement vector. Verify the command, the proxy account, and who can create or run the job.
MSSQL-SRVROLE-MEMBER-ADD🟠 highA login was added to a fixed server role (ALTER SERVER ROLE ... ADD MEMBER or sp_addsrvrolemember). Server-role membership grants instance-wide capabilities to the login and is a standing privilege change, not a one-time action. Verify the login requires the role.
MSSQL-SRVROLE-SYSADMIN🔴 criticalA login was added to sysadmin or securityadmin. sysadmin grants unrestricted control of the SQL Server instance; securityadmin can grant itself sysadmin-equivalent access. This is a full-instance privilege escalation. Verify the login, the requester, and the change ticket.
MSSQL-ROLE-MEMBER-ADD🟡 mediumA principal was added to a database role (ALTER ROLE ... ADD MEMBER or sp_addrolemember). Role membership is a standing access change that persists beyond this script. Verify the principal requires the role.
MSSQL-DBROLE-ADMIN-ADD🟠 highA principal was added to a privileged fixed database role (db_owner, db_securityadmin, db_accessadmin, or db_ddladmin). These roles control permissions, access, or schema for the entire database — membership is a database-level privilege escalation. Verify the principal and the justification.
MSSQL-ROLE-MEMBER-DROP🟡 mediumRole membership removed (ALTER [SERVER] ROLE ... DROP MEMBER or sp_droprolemember / sp_dropsrvrolemember). Removing membership can silently revoke access that applications or operators depend on, and in incident scenarios is also used to lock out responders. Verify the removal is intended.
MSSQL-OWNER-XFER🟠 highALTER AUTHORIZATION transfers ownership of a securable to another principal. The new owner gains full control of the object, including the right to grant access to others. Verify approval and ensure proper access controls remain in place.
MSSQL-LOGIN-DISABLE🟡 mediumALTER LOGIN ... DISABLE blocks a server login from connecting. Disabling logins is a routine hardening action but also appears in incident lockouts and sabotage. Verify the login is intended to lose access and that no application depends on it.
MSSQL-LOGIN-ENABLE🟡 mediumALTER LOGIN ... ENABLE re-activates a server login. Re-enabling a dormant or previously disabled account restores its access; dormant-account re-activation is a common persistence vector. Verify the business need.
MSSQL-LOGIN-PWD-CHG🟠 highALTER LOGIN changes a login's password. Password changes outside a managed rotation process can lock out applications or indicate account takeover. Verify the requester and the rotation process.
MSSQL-LOGIN-CHG🟡 mediumALTER LOGIN modifies a server login (default database/schema, name, policy options, or credential mapping). Login changes affect authentication behavior for every session the login opens. Verify the change is intended.
MSSQL-LOGIN-DROP🟡 mediumDROP LOGIN removes a server login. Sessions already open stay alive, but new connections fail — applications using this login break at their next reconnect. Verify nothing still authenticates with it.
MSSQL-APPROLE-NEW🟡 mediumCREATE APPLICATION ROLE adds a password-activated database principal. Application roles bypass user-level permissions once activated (sp_setapprole), so their password is effectively a shared credential. Review how the password is stored and who can activate the role.
MSSQL-EXECAS-LOGIN🟠 highEXECUTE AS LOGIN switches the session to another server login's security context. Every subsequent statement runs with that login's permissions across the whole instance — a server-level impersonation. Verify the caller is entitled to impersonate this login and that a REVERT follows.
MSSQL-EXECAS-USER🟡 mediumEXECUTE AS USER switches the session to another database user's security context. Subsequent statements run with that user's permissions in the current database. Verify the impersonation is intended and that a REVERT follows.
MSSQL-EXECAS-NO-REVERT🟠 highEXECUTE AS ... WITH NO REVERT makes the context switch permanent for the session — the original identity cannot be restored. Connection-pooled applications can leak the impersonated identity to unrelated requests. Verify this is intended.
MSSQL-SETUSER-IMPERSONATION🟡 mediumSETUSER switches the database security context to another user — the deprecated, database-scoped equivalent of EXECUTE AS USER. Subsequent statements run with that user's permissions, and SETUSER is a long-standing privilege-escalation and audit-evasion vector. Use EXECUTE AS with a matching REVERT instead, and verify the impersonation is intended.
MSSQL-SERVICE-MASTER-KEY-FORCE-REGENERATE🟠 highALTER SERVICE MASTER KEY FORCE REGENERATE re-keys the root of the SQL Server encryption hierarchy and, because it is forced, discards any key material and data that can no longer be decrypted — an irreversible data-loss operation. Confirm a backup of the service master key exists and that the forced loss is intended.
MSSQL-SERVICE-MASTER-KEY-REGENERATE🟠 highALTER SERVICE MASTER KEY REGENERATE re-keys the root of the SQL Server encryption hierarchy, re-encrypting everything it protects. This is a high-impact operation on the instance's entire encryption chain; confirm it is intended and that the service master key is backed up.
MSSQL-SERVICE-MASTER-KEY-INLINE-PASSWORD🟠 highALTER SERVICE MASTER KEY changes the protecting service-account credentials using a hardcoded password (WITH { OLD | NEW }_PASSWORD = '...'). The service-account password sits in the script in plaintext. Supply it out of band, not as a literal.
MSSQL-CRED-NEW🟠 highCREATE [DATABASE SCOPED] CREDENTIAL stores an identity (and usually a secret) for reaching an external resource. Credentials govern what the instance can touch outside itself — review the identity, where the secret came from, and which principals can use the credential.
MSSQL-CRED-DROP🟡 mediumA credential was dropped. Anything that authenticated through it (external data sources, backups to URL, proxies) fails at next use. Verify nothing still depends on it.
MSSQL-CRYPTO-CHG🟡 mediumAn encryption-hierarchy object or credential was altered (regenerate, re-encrypt, identity/secret change). Key rotation outside a managed process can make encrypted data unreadable or break signed modules. Verify the change procedure.
MSSQL-CRYPTO-DROP🟠 highAn encryption-hierarchy object (master key, symmetric/asymmetric key, or certificate) was dropped. Data encrypted under it becomes unrecoverable, and modules signed by it lose their permissions. Verify nothing remains encrypted or signed with this object.
MSSQL-AUDIT-CHG🟡 mediumA SQL Server audit or audit specification was altered. Changes to the audited action groups, destination, or filter change what activity is captured. Verify the change preserves required coverage.
MSSQL-AUDIT-DISABLE🟠 highA SQL Server audit or audit specification was switched to STATE = OFF. Activity capture stops immediately — disabling auditing is a standard precursor to unauthorized activity and usually violates compliance requirements. Verify approval.
MSSQL-AUDIT-DROP🟠 highA SQL Server audit or audit specification was dropped. Activity capture configuration is removed entirely. Verify a replacement audit exists if coverage is required.
MSSQL-DB-TRUSTWORTHY-ON🔴 criticalALTER DATABASE ... SET TRUSTWORTHY ON marks the database as trusted by the instance. Combined with db_owner membership, TRUSTWORTHY allows escalation to sysadmin via modules signed by the database owner. Microsoft recommends leaving it OFF; verify the requirement and prefer certificate signing.
MSSQL-DB-CHAINING-ON🟠 highALTER DATABASE ... SET DB_CHAINING ON enables cross-database ownership chaining for this database. Permission checks are skipped across the database boundary, so a low-privilege database can become a path into this one. Verify the dependency that requires chaining.
MSSQL-DB-ENCRYPTION-OFF🟠 highALTER DATABASE ... SET ENCRYPTION OFF disables transparent data encryption. Data files, log files, and backups written after this change are stored unencrypted. Verify the change is approved and compliant.
MSSQL-SPCONFIG-OLE-AUTOMATION🔴 criticalsp_configure invoked with 'Ole Automation Procedures'. Enabling OLE Automation lets T-SQL instantiate COM objects (sp_OACreate), which can read and write files, call the network, and execute code under the SQL Server service account — an xp_cmdshell-equivalent escape hatch. Verify intent and audit the surrounding context.
MSSQL-SPCONFIG-CLR🟠 highsp_configure invoked with a CLR option ('clr enabled' or 'clr strict security'). Enabling CLR, or relaxing CLR strict security, allows user assemblies to run inside the server process; UNSAFE assemblies execute arbitrary native code under the service account. Verify the assembly governance story before changing CLR configuration.
MSSQL-SPCONFIG-ADHOC-QUERIES🟠 highsp_configure invoked with 'Ad Hoc Distributed Queries'. Enabling this lets any caller use OPENROWSET/OPENDATASOURCE with inline connection strings — ad-hoc remote connections that bypass linked-server governance and are a common exfiltration channel. Verify intent.
MSSQL-SPCONFIG-XDB-CHAINING🟠 highsp_configure invoked with 'cross db ownership chaining'. Instance-wide ownership chaining lets permissions checks be skipped across database boundaries, so a low-privilege database can become a path into a sensitive one. Scope chaining per-database if it is required at all.
MSSQL-SPCONFIG-REMOTE-ACCESS🟡 mediumsp_configure invoked with 'remote access'. This legacy option controls remote-server RPC execution against the instance. Changing it widens or narrows which remote servers can run procedures here. Verify the change is intended.
MSSQL-SPCONFIG-DAC🟡 mediumsp_configure invoked with 'remote admin connections'. Enabling the remote Dedicated Admin Connection exposes the emergency sysadmin endpoint over the network instead of local-only. Verify the operational need and the network controls in front of it.
DNY-PRIV🟡 mediumDENY statement detected. Explicit privilege denial overrides GRANT and blocks access. Verify this is intentional and documented.
DNY-ALL-PRIV🟠 highDENY ALL PRIVILEGES detected. This blocks all access to the securable and overrides any existing grants.
DNY-TO-PUBLIC🔴 criticalDENY to PUBLIC detected — affects ALL database users/principals. This overrides individual grants and may require admin-level intervention to reverse.
DNY-CASCADE🟠 highDENY with CASCADE detected. This propagates the denial to all principals who received the privilege via the target principal.
DNY-AS-PRINCIPAL🟠 highDENY with AS clause detected. This executes the denial on behalf of another principal, which may indicate privilege escalation or impersonation.
SCRIPT-SILENT-HANDLER🟠 highDECLARE CONTINUE HANDLER FOR SQLEXCEPTION without RESIGNAL silently swallows all errors. This is the SQL equivalent of a bare 'except: pass' — failures will be invisible and the procedure will continue with potentially corrupt state. Add RESIGNAL to re-raise after logging, or use EXIT HANDLER instead.

Generated from builtin_rules.yaml at build time.

Need Help?

Can't find what you're looking for? Check out our GitHub or reach out to support.

GitHub IssuesEmail Support