A migration tool or framework is in use
Why it matters
Without a migration tool, schema changes are applied by hand through a database GUI or cloud console — changes that are invisible to version control, not reproducible across environments, and impossible to roll back systematically. When the production schema diverges from the development schema, bugs surface only in production. ISO 25010 recoverability requires that the system can be restored to a known state; without a migration history, the schema cannot be reliably reconstructed after a failure. Prisma's db push shortcut is specifically not a migration tool — it applies schema changes without creating a history file, meaning it cannot be used to reproduce or audit schema evolution.
Severity rationale
High because schema changes without version control cannot be audited, replicated across environments, or rolled back — any schema divergence between environments causes hard-to-diagnose bugs.
Remediation
Set up a migration tool that matches your ORM and commit all migration files to version control. For Prisma, switch from db push to migrate dev for development and migrate deploy for production.
# Prisma — create migration from schema changes
npx prisma migrate dev --name add_user_role_column
# Apply migrations in production
npx prisma migrate deploy
# .github/workflows/deploy.yml — run migrations before deploying
- name: Run database migrations
run: npx prisma migrate deploy
env:
DATABASE_URL: ${{ secrets.DATABASE_URL }}
For Supabase, use supabase migration new <name> to create versioned SQL files in supabase/migrations/. Never apply schema changes through the Supabase dashboard without capturing them in a migration file.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Database Design & Operations Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.recoverability — Recoverability
- soc2:2017 · CC8.1 — Change management
Taxons
History
- 2026-04-18·v1.0.0·Initial import from database-design-operations·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (CC8.1) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2