Been building open-source Postgres tools for a decade now, and one things keeps popping up... it's way too easy to build insecure databases.
We built safegres to address this (and more to come) — it's an open-source, read-only Postgres auditor that inspects the system catalogs and uses PostgreSQL's own grammar to analyze policies and functions as ASTs rather than relying on regex.
It gives you two independent grades: security and performance. It also runs in CI, so you can improve your development loop. We found that agents that can see your CI will just pick this up and start improving your code w/o too much instruction.
I'd love feedback from anyone who's worked with complex RLS policies, multi-tenant Postgres, or agent-generated schemas. Especially interested in edge cases we're missing or places where our analysis might be wrong.
Hey HN, Dan here, founder of Constructive.
Been building open-source Postgres tools for a decade now, and one things keeps popping up... it's way too easy to build insecure databases.
We built safegres to address this (and more to come) — it's an open-source, read-only Postgres auditor that inspects the system catalogs and uses PostgreSQL's own grammar to analyze policies and functions as ASTs rather than relying on regex.
It gives you two independent grades: security and performance. It also runs in CI, so you can improve your development loop. We found that agents that can see your CI will just pick this up and start improving your code w/o too much instruction.
I'd love feedback from anyone who's worked with complex RLS policies, multi-tenant Postgres, or agent-generated schemas. Especially interested in edge cases we're missing or places where our analysis might be wrong.
Thanks for taking a look!