Every way we normally answer "is this safe to ship" answers a different question. The suite runs against a seeded database that is small and empty, so it cannot tell you the migration holds a lock for ninety seconds at production's row counts. Staging reaches the real vendor, so it cannot tell you whether the path that charges a card would have charged one. Reading an ALTER TABLE in review cannot tell you whether it rewrites the table, because the statement does not say; it depends on the server version and the type you are coming from. So Antifailure builds the copy instead, one per branch, and destroys it afterwards. Real schema, real data volume, every identifier masked, and the masking is proved rather than asserted: a scanner reads the result back with the same detectors that would find a leak and signs an attestation, and a copy that fails it cannot be used. The environment sits on a network with no route out, so an SDK that ignores its proxy settings has nowhere to send the packet. Then agents drive a real browser through it and come back with pass, fail, flaky, blocked or unverified, with a video and a trace. The thing I am proudest of is not a feature. Yesterday our own masking verifier reported clean about a database in which the plan listed 145 columns as copied unchanged, nine of them Stripe customer ids and two of them sealed key material. It read six text types and treated everything it could not read as fine. We found it by pointing the product at itself, and the fix shipped in today's release: it now reads every column it can read as text, names the ones it cannot, and fails rather than passes when a column it could not read has no rule and a name that says it holds a secret. The engine is MIT licensed and needs no account: curl -fsSL https://antifailure.dev/install.sh | sh af init && af up What is the worst thing a migration has done to you in production? Most of the ones I collect are things a copy would have caught.

Antifailure

A disposable copy of production for every pull request

A disposable copy of production for every pull request