Database migrations are one of those things that often look harmless during code review. A migration may contain only a few lines of SQL, the application tests are green, and everything seems ready to deploy. But a small migration can still contain something like this: public function up ( Schema $schema ): void { $this -> addSql ( 'ALTER TABLE users DROP COLUMN legacy_code' ); } Or this: public function up ( Schema $schema ...