SqlGrantOptionWarn
Last updated: January 22, 2026
Detects WITH GRANT OPTION statements, which allows the recipient to pass permissions on to other users, helping you prevent privilege escalation security risks which could spread beyond intended recipients.
Uses
Property | Value |
Liquibase version required | 4.6.0+ |
Scope (--checks-scope) | changelog |
Default status | enabled |
Default severity (exit code) | 0 ("INFO") |
Customizable settings | No (static) |
Note: SqlGrantOptionWarn only supports unmodeled changeset types. If you use this Policy Check with modeled changesets (XML, JSON, and YAML changelogs as well as all ChangeTypes except sql and sqlFile), a message will appear stating the changeset was skipped.
Before you begin
Ensure that you have correctly specified your Liquibase Secure license key.
Ensure that the
--checks-scopeparameter includes the scope of this check.Changelog checks prerequisites
loadingloadingloadingloadingloading
Procedure
Enable
This check is enabled by default. To verify that it is currently enabled, run the checks show command:
liquibase checks show --check-name=<string>
To run the check, use the checks run command.
Note: For flow files you'll need to run liquibase flow to apply your changes.