SEC.SKIPPED.NOTHING_CHECKED — The security run examined nothing
- Category: security
- Level: 0
- Downtime class: none — the notice is about the run, not about a statement
- Stability: stable
- Suites: security
What it means
A part of sqlens:security examined nothing. The run has three: the live-catalog half, which reads
the database the way sqlens:audit does, the migration half, which reads your migrations the way
sqlens:lint does, and the injection half, which reads what PHPStan found at raw-SQL call sites.
Each part that could not look reports this notice, with the part's name in the message. When neither
the live-catalog half nor the migration half examined anything, one more notice names the
connection.
This is not a clean result, and it is reported as undetermined rather than left silent for
exactly that reason: an empty report and a report over a healthy database look identical, and the
second is the reading a person makes.
Which reason it carries
The undetermined_reason names the cause, so a pipeline can tell a thing to fix from a thing to
decide:
| Reason | The part examined nothing because |
|---|---|
unsupported_engine | the connection uses an engine this package does not examine: SQLite, SQL Server, a MariaDB behind the mysql driver, or a driver nobody registered |
server_below_supported_floor | the server is older than the oldest version this package supports |
unknown_server_version | the version of the server, or which engine it really is, could not be established |
structurally_not_applicable | the connection declares no driver |
connection_not_configured | nothing defines a connection under that name |
sub_run_failed | the part failed, refused before it read anything, or could not read the result it was pointed at; the message says why |
not_configured | nobody asked the part to run, as with an injection half that is switched off or names no result to read |
A part that refused before it read takes the reason of the refusal where the refusal has one, for
instance connection_not_configured when more than one connection could be the one to examine and
none was chosen. The notice for the whole run carries the reason both halves give, and
sub_run_failed when they give different ones. A part nobody asked to run does not count there.
Why the exit code is still 0
An undetermined moves the exit code only under strict_undetermined — a decision your project
makes once, not one this command makes for you. The report says what happened; the strict flag says
what it costs.
// config/sqlens.php — make an unanswerable check fail the run
'strict_undetermined' => true,
With that set, this notice fails the run, which is the correct behavior for a pipeline that must not proceed on an unexamined database.