SqlGrantOptionWarn

Last updated: January 22, 2026

Detects WITH GRANT OPTION statements, which allows the recipient to pass permissions on to other users, helping you prevent privilege escalation security risks which could spread beyond intended recipients.

Uses

Property

Value

Liquibase version required

4.6.0+

Scope (--checks-scope)

changelog

Default status

enabled

Default severity (exit code)

0 ("INFO")

Customizable settings

No (static)

Note: SqlGrantOptionWarn only supports unmodeled changeset types. If you use this Policy Check with modeled changesets (XML, JSON, and YAML changelogs as well as all ChangeTypes except sql and sqlFile), a message will appear stating the changeset was skipped.

Before you begin

  1. Ensure that you have correctly specified your Liquibase Secure license key.

  2. Ensure that the --checks-scope parameter includes the scope of this check.

    Changelog checks prerequisites

    loading

    loading

    loading

    loading

    loading

Procedure

1

Enable

This check is enabled by default. To verify that it is currently enabled, run the checks show command:

liquibase checks show --check-name=<string>

2

To run the check, use the checks run command.

loading

loading

Note: For flow files you'll need to run liquibase flow to apply your changes.