Run your first tenant-isolation scan.

Requirements

Use Node.js 20 or newer and run the command from a repository containing ordered SQL migrations. BoundaryCI automatically detects common Supabase layouts, or you can select a profile explicitly.

Scan the repository

The default terminal report includes each finding's rule, severity, source location, evidence, and recommended remediation.

npx boundaryci scan .
# Windows PowerShell when npx.ps1 is blocked:
npx.cmd boundaryci scan .

Adopt an existing repository

Review the current findings before creating a baseline. Commit the baseline so CI can distinguish existing debt from a new regression.

npx boundaryci baseline .
git add .boundaryci/baseline.json

Generate explicit configuration

A configuration file records migration directories, exposed schemas, ignored shared tables, failure threshold, and optional Fireworks review settings.

npx boundaryci init

Understand exit codes

Exit code 0 means the scan completed without a new non-waived finding at the selected threshold. Exit code 1 means the threshold was met. Exit code 2 means configuration or execution failed.

Connect a repository to BoundaryCI Cloud

Create the organization and repository in BoundaryCI Cloud. Copy the one-time repository token, then save it in GitHub under Settings, Secrets and variables, Actions as a repository secret named BOUNDARYCI_CLOUD_TOKEN.

The token is the private credential. The workflow YAML is not private: it contains only the secret name and BoundaryCI ingestion URL. Every repository dashboard keeps the exact file path and YAML available under Setup guide, even after the token screen is closed.

Organization owners and administrators can use Add repository to repeat this flow for additional GitHub repositories. Each connection receives a separate bound token and history; scans share the organization’s monthly allowance.

BOUNDARYCI_CLOUD_TOKEN

Verify the first pull request

Commit the generated workflow to the default branch, then open a pull request that contains an SQL migration. BoundaryCI scans inside GitHub, annotates unsafe lines, uploads the minimized result, and preserves corrected reruns in Cloud history.

A failed BoundaryCI check can be the expected result: it means a new finding met the configured failure threshold. Correct the migration on the same branch and push again; the Action reruns automatically.

Choose whether to enable managed AI review

On Team, Growth, and Enterprise, an owner or administrator can review the dashboard disclosure and authorize managed Fireworks AI once for the organization. New repositories then request semantic review automatically with the same BoundaryCI repository token; customers do not need a Fireworks account or key.

BoundaryCI checks consent before the runner transmits migration content. When authorized, common secret patterns are redacted locally and up to 80,000 characters pass through BoundaryCI to Fireworks without being stored as migration text. Only normalized findings enter Cloud history.

          managed-fireworks: "false"