Data integrity and migrations
Cascade delete removes more than intended
Deleting a parent record silently removes children the product meant to keep.
Termsmigration (a scripted change to the database schema that ships with a release and should be reversible) · staging environment (a copy of production, without customer data, where release candidates are tested) · protected branch (the git branch that cannot be pushed to directly and is the only source of production deploys)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Foreign keys are generated with cascade because it makes deletes succeed. CodeRabbit measured logic and correctness issues 75% more common in AI-co-authored pull requests.
In the same 470-pull-request sample, cross-site scripting issues were up to 2.74 times more frequent in AI-co-authored pull requests; error-handling gaps were nearly 2 times more common and logic and correctness issues 75% more common.
Source: CodeRabbit, 2025-12-17 · verified 2026-09-21
How we detect it
Delete one parent of each type in staging and list what went with it.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Stacks: Supabase
Checklist items that catch it
Cascade deletes are reviewed
manual In staging, delete one parent record of each type and list the rows removed by cascade.
The removed rows match the written deletion policy for that record type.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in data integrity and migrations
- critical
- critical
- high
- high
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.