Adversarial corpus

The adversarial corpus is how Midplane earns trust: a curated set of SQL bypass attempts that must stay denied and legitimate queries that must stay allowed. It is intentionally short on marketing and long on SQL. It exists to answer one question — what does Midplane actually catch, and where are its limits? The corpus lives in the repo as docs/adversarial-corpus.md and mirrors the test suite under packages/engine/test/adversarial/ one-to-one: every row maps to one assertion. Humans review the doc; CI gates on the tests. The corpus is the contract, and the repo is its source of truth.

100+ bypass attempts denied and 50+ legitimate-query controls allowed (and growing), with 100% line coverage on the policy surface (packages/engine/src/policy/*). The repo is the live source of truth for the exact counts. The denials prove Midplane blocks what it should; the allowed controls prove it doesn’t break legitimate work. False positives are bugs we triage; bypasses are release blockers.

Conservative by default

When in doubt, the corpus denies. Anything the parser can’t faithfully model is denied rather than allowed — Midplane accepts false denials to never accept a false allow. Tightening a known gap is a feature; a missed bypass is a release blocker.

Illustrative examples

A few entries, lifted directly from the corpus. The full set lives in the repo — the source of truth these snippets read from.

Must stay denied

SQL	Verdict	Rule	Why it matters
`WITH x AS (DELETE FROM y RETURNING ) SELECT FROM x`	DENY	`table_access`	The write hides inside a CTE; the recursive walk catches it.
`SELECT 1; DROP TABLE users;`	DENY	`multi_statement`	The canonical Datadog stacked-statement vector.

Must stay allowed

SQL	Verdict	Why it stays legitimate
`SELECT 'a; DROP TABLE x; --b'`	ALLOW	A stacked-injection-shaped string is still one literal, one statement.
`SELECT data->>'name' FROM events`	ALLOW	Postgres JSON syntax parses cleanly.

Known limitations

A few shapes currently allow where an audit mindset would prefer a deny. These are documented gaps, not patched-around bypasses — Midplane ships a small, predictable rule surface, and tightening any of these adds policy state deferred to a follow-up release.

SQL	Verdict	Why it’s a gap
`SELECT pg_terminate_backend(123)`	ALLOW	A SELECT-wrapped admin function. AST-level write detection can’t distinguish side-effecting `pg_*` functions from pure ones without a denylist.
`BEGIN`	ALLOW	Transaction control. Midplane commits per query, so `BEGIN` is a pipeline no-op.
`PREPARE my_p AS SELECT 1`	ALLOW	Session-state mutation. Tightening requires session-scope tracking; deferred.

The repo tracks the full list of gaps. If your threat model needs any of these tightened today, that’s a known gap rather than a bug — open an issue and we’ll either backport the tightening or prioritize it.

Contribute a bypass

Found a SQL shape that gets through? That’s the single highest-leverage contribution to the project. Add a row to the markdown table and a matching assertion in the test suite — kept one-to-one. See contributing for the workflow.