Command that deletes or overwrites data

Recursive deletes, dropped databases, truncates, unfiltered bulk deletes, force pushes.

Check destructive-opsShip Check

Why it matters

Agents often reach for the broadest command that makes a problem go away. A cleanup script gets rm -rf on a variable path, a reset function loses its filter and becomes deleteMany({}), a stuck branch gets git push --force. Each one works on the agent's machine and reads as a reasonable fix in the transcript.

The cost appears wherever that code runs next. An empty variable turns a scoped delete into a wide one, an unfiltered bulk delete removes every tenant's records rather than one, and a force push discards other people's commits. None of these can be undone from inside the app.

Example

 export async function resetWorkspace(workspaceId: string) {
-  await prisma.document.deleteMany({ where: { workspaceId } });
+  await prisma.document.deleteMany({});
   await prisma.workspace.update({
     where: { id: workspaceId },
     data: { resetAt: new Date() },
   });
 }

What it detects

• Recursive force deletes (rm -rf and similar flag combinations), except on paths such as node_modules, dist, build, .next, /tmp and coverage.
• DROP DATABASE, DROP SCHEMA, TRUNCATE, Redis FLUSHALL and FLUSHDB, and git push --force without --force-with-lease.
• Bulk deletes with no filter: deleteMany() or deleteMany({}), delete_many, destroy_all, deleteAll().
• A complete single-line DELETE FROM or UPDATE statement with no WHERE clause. A multi-line statement whose WHERE sits on the next line is deliberately not flagged.
• Only added lines in executable files are checked. Migrations are left to migration-safety, and comments, regex definitions, prose strings and diff fixtures in tests are skipped.

What to do when it fires

Confirm the operation is meant to be this wide. Restore the filter or narrow the path, and guard against empty variables in shell paths (for example with set -u and an explicit check before the delete).

If the command is legitimate, such as a local reset script, make sure it cannot run against a live environment: check the environment name, require a confirmation flag, or keep it out of code paths that deploy. Use --force-with-lease instead of --force.