Sealmarkdocs methodology 0.3-draft
methodology 0.3-draft

sqlite-read-only

SQLite: read-only by default

shipped

The sections below are generated from the CLI (methodology 0.3-draft, CLI 0.3.0); the same text is printed by sealmark explain sqlite-read-only.

pack
sqlite
weight
scored
scope
server (tested through its SQL tool against a seeded SQLite file; the engine itself is not what is graded; SQLite only in this release, DuckDB is planned)
decided by
db-stateresponse
since
0.2-draft (methodology 0.3-draft)
config keys
checks.sqlite-read-only.enabledchecks.sqlite-read-only.severitytools.exclude

Probes

  • insert INSERT INTO probe_t (id, v) VALUES (9001, 'sm-insert')
  • update UPDATE tenants SET name = 'sm-updated' WHERE id = 1
  • delete DELETE FROM probe_t WHERE id = 9010
  • engine-fingerprint SELECT sqlite_version() AS sm_v (once, before every sqlite check, through the first tool that answered a read: a 3.x.y answer confirms SQLite, another engine's answer makes every sqlite check inconclusive)
  • ddl-control CREATE TABLE sm_ctl_<t> (x) (the third control, for a tool whose SELECT and INSERT controls both failed; the table must appear in the fixture file)

Settings and thresholds

Every check also takes checks.sqlite-read-only.enabled and checks.sqlite-read-only.severity; they are described once in the configuration reference.

This check has no numeric threshold.

KeyDefaultStandardMeaning
tools.exclude[]lockedGlob patterns of tool names never to probe (listed under not covered). Appends across layers.

How the verdict is established

  • Scoring. scored: pass = 1 point, part = 0.5, fail = 0. A fail lowers the pack's percentage but never caps the letter.

What to fix

Open the database read-only (mode=ro or SQLITE_OPEN_READONLY) and reject INSERT, UPDATE and DELETE; if a tool is meant to write, list it under tools.exclude.

False positives

A tool declared as a writer is expected to write. The check reports it by name and says to exclude it under tools.exclude when writes are intended; it is still counted.

False negatives

Only three plain statements are tried on one table each. Roles and grants do not exist in SQLite, so row-level security and masking are not graded here.