Liste de vérification pour la révision des requêtes SQL générées par l'IA

Une checklist de révision humaine pour les requêtes SQL générées par des agents IA — exactitude, injection, performances et migrations.

L’IA écrit du SQL rapidement, mais pas toujours en toute sécurité. Passez chaque requête générée par l’IA au crible de cette checklist avant de fusionner.

Exactitude

[ ] Joins use the right keys (no accidental cross joins)
[ ] NULL handling is intentional (COALESCE / IS NULL, not = NULL)
[ ] Aggregates have correct GROUP BY columns
[ ] Pagination is stable (ORDER BY a unique column)

Sécurité

[ ] No string-concatenated SQL — parameterised queries only
[ ] User input never reaches identifiers (table/column names)
[ ] Row-level access is enforced (tenant_id / user_id filter present)

Performances

[ ] Queries hit an index (check EXPLAIN for Seq Scan on large tables)
[ ] No SELECT * in hot paths
[ ] N+1 patterns batched or joined

Migrations

[ ] Migration is reversible (or explicitly one-way and documented)
[ ] No blocking locks on large tables during deploy
[ ] Defaults/backfills won't rewrite the whole table synchronously

Invite de correction

Review this SQL against the checklist above. Parameterise any concatenated
input, add the missing tenant filter, and confirm the query uses an index
with EXPLAIN. Return the corrected query only.