Checks

Edition: Community and Enterprise

sealfix checks every template and its values when they are submitted, before anything is stored or sealed. An error blocks the submit; a warning is shown to the DBA reviewer. An administrator can set the level of most checks per environment, under policies.<env>.checks.

pie showData
    title Checks by default level
    "Error (blocks submit)" : 10
    "Warning (shown to the reviewer)" : 3

Code	Default level	Levels allowed	What it checks
C1	error	always an error	Only UPDATE, DELETE and INSERT; no procedural blocks, no empty template, an UPDATE has SET assignments.
C2	error	error, warning or off	UPDATE and DELETE have a WHERE that restricts rows (not 1=1, x = x, ROWNUM, ROWID, ctid).
C3	error	always an error	One table per statement: joins only in WHERE; no INSERT ... SELECT.
C4	error	always an error	No sensitive literal: a value pattern in the template text (comments included), or a literal compared with a sensitive column, also where the column stands inside a function, a cast or parentheses (UPPER(name) = '...').
C5	error	error or warning, never off	The template's parameters equal the declared ones; named binds (:name) only.
C6	error	error, warning or off	Every table is in the target's allowlist.
C7	error	always an error	No function on the target's denylist (for example xp_cmdshell, UTL_HTTP).
C8	error	error or warning, never off	A parameter bound to a sensitive column is not declared as id, text, amount or code, also where the column or the parameter stands inside an expression (UPPER(name) = UPPER(:p)).
V1	error	error or warning, never off	At submit: no value of an id, text, amount or code parameter looks like a national ID, card, IBAN, mobile number or email, and every code value is a code.
W1	warning	error, warning or off	The table has no primary or unique key: no rollback.
W2	warning	error, warning or off	WHERE applies a function to a column: the index may be skipped.
W3	warning	error, warning or off	A LIKE pattern starts with %: a full scan.
PARSE	error	always an error	The template does not parse. Not a check: it always fails.

Check messages name statements, tables, columns, parameters and kinds, never a value.