SqlGrantWarn

Last updated: January 22, 2026

Alerts when SQL code contains GRANT statements that assign database privileges to users or roles, helping review potential security vulnerabilities by ensuring permissions are appropriately scoped and do not provide unintended access.

Uses

Property

Value

Liquibase version required

4.5.0+

Scope (--checks-scope)

changelog

Default status

enabled

Default severity (exit code)

0 ("INFO")

Customizable settings

No (static)

Note: SqlGrantWarn only supports unmodeled changeset types. If you use this Policy Check with modeled changesets (XML, JSON, and YAML changelogs as well as all ChangeTypes except sql and sqlFile), a message will appear stating the changeset was skipped.

Before you begin

  1. Ensure that you have correctly specified your Liquibase Secure license key.

  2. Ensure that the --checks-scope parameter includes the scope of this check.

Changelog checks prerequisites

loading

loading

loading

loading

loading

Procedure

1

Enable

This check is enabled by default. To verify that it is currently enabled, run the checks show command:

liquibase checks show --check-name=<string>

2

To run the check, use the checks run command.

loading

loading

Note: For flow files you'll need to run liquibase flow to apply your changes.