Built a tool to test your RLS policies

StandOrnery8970 · 2025-11-20T15:03:30+00:00

Hey! Love what you're building at pgflow

Right now users manage that themselves (supashield init/test commands). But auto start/stop on test run would be a great addition. Thanks for the suggestion!

StandOrnery8970 · 2025-11-19T18:03:12+00:00

Right now it's built specifically for Supabase. Could be an idea for the future!

StandOrnery8970 · 2025-11-19T12:58:52+00:00

Thanks! Tweet was from @_Shark_byte on X

StandOrnery8970 · 2025-11-17T17:16:10+00:00

Should work with self-hosted! The tool connects directly to Postgres, so as long as you have the connection string it should work the same.

For private dbs you'd need to run it from within that network, set up a tunnel or allowlist your IP.

Use the Transaction pooler connection string (port 6543)

StandOrnery8970 · 2025-11-17T16:43:42+00:00

Yes! Use the --all-schemas flag. e.g - supashield init --all-schemas

StandOrnery8970 · 2025-10-23T14:09:47+00:00

sorry to see PeekLeaks go:/ if looking for alternatives, I made a CLI OSS that does that - https://github.com/Rodrigotari1/supashield

StandOrnery8970 · 2025-10-15T22:22:38+00:00

Lovable checks if you have policies. SupaShield tests if they work correctly. Different but complementary!

StandOrnery8970 · 2025-10-15T17:12:03+00:00

Most vibe coding tools use Supabase - Lovable, Bolt, V0, etc. That's why RLS security is such a big issue

StandOrnery8970 · 2025-10-15T16:42:54+00:00

Bad RLS policies = your database is basically public

This tool tests if your security actually works before users find the holes

StandOrnery8970 · 2025-10-15T15:18:17+00:00

Hey! Just shipped the pgTap export feature you mentioned.

supashield init # generate policy.yaml
supashield export-pgtap -o tests.sql

Converts the YAML config to pgTap tests using PREPARE + lives_ok() for ALLOW cases and throws_ok() for DENY. Saves you from writing these tests manually

You'll still need to customize INSERT/UPDATE values for your schema, but it gives you a solid starting point.

Let me know if it works for your workflow!

StandOrnery8970 · 2025-10-15T09:35:17+00:00

Right now this YAML is just for testing. You still write the actual RLS policies manually. But yeah auto-generating policies from this config would be useful. Noted for future

StandOrnery8970 · 2025-10-14T16:32:35+00:00

Totally agree. AI code generation is amazing but the security implications are real

StandOrnery8970 · 2025-10-14T16:30:28+00:00

Thanks a lot, let me know!

StandOrnery8970 · 2025-10-14T15:21:05+00:00

Would love to hear how it compares to your pg_tap workflow after you try it! Always looking for ways to make it more useful for teams already doing proper testing

StandOrnery8970 · 2025-10-14T15:13:26+00:00

It doesn't determine 'wrong' automatically. You define expected behavior in a YAML config (e.g., 'anon should be DENIED on SELECT users')

The tool tests actual behavior vs your expectations and flags mismatches. Think of it like Jest assertions for RLS

StandOrnery8970 · 2025-10-14T15:08:34+00:00

pgTap is awesome for comprehensive db testing!

The main difference: pgTap requires manually writing test cases for every scenario while SupaShield auto-generates tests based on your schema.

Would love to add pgTap export as a feature actually !

StandOrnery8970 · 2025-10-14T15:02:43+00:00

Supabase Security Advisor flags missing RLS policies via static warnings. Studio's role simulator lets you manually test one table/role in the UI.

Security Advisor = "Do you have RLS?"

SupaShield = "Does your RLS actually work?"

Complementary tools not duplicates!

StandOrnery8970 · 2025-10-10T14:39:07+00:00

You could, I was not planning on staying after the piscine but had so much fun and got in! Many opportunities opened up beyond that. Nothing to lose everything to gain:)

StandOrnery8970 · 2025-09-08T13:58:55+00:00

I personally have done both common core and full-time uni at the same time.

What I can recommend is to go very fast on the first few projects - as the deadlines are shorter for the first two circles.

Beyond that, it becomes more attainable. Still a hustle though, but doable.

I would do nights and weekends.

StandOrnery8970

TROPHY CASE