built this for flask + SQLAlchemy codebases because existing SQL linters only see .sql files, which is useless when the SQL doesn't exist until runtime, or they are AI garbage tools
valk-guard reads the python AST, walks SQLAlchemy chains (session.query, select, filter, join), reconstructs the SQL the ORM will generate, parses it with a real postgres grammar, runs 19 rules. catches DELETE/UPDATE without WHERE, SELECT *, leading wildcard LIKE, CREATE INDEX without CONCURRENTLY, plus schema drift between models and migrations.
deterministic. no LLM, no DB connection. runs in CI in seconds.
postgres only. SQLAlchemy 1.x works, 2.0 mapped_column half-done+ SQL migration file
https://github.com/ValkDB/valk-guard
would appreciate feedback from anyone running flask + SQLAlchemy in prod, especially on patterns you think this would miss.
