{"slug": "ls-guard-generate-and-audit-postgres-supabase-rls-from-a-spec", "title": "Ls-guard: generate and audit Postgres/Supabase RLS from a spec", "summary": "Rls-guard, a new open-source tool, generates and audits Postgres/Supabase row-level security (RLS) policies from a YAML spec, addressing misconfigured RLS that exposed 303 endpoints across 170 apps in CVE-2025-48757. The tool's core loop converts a permission spec into SQL migrations and audits live databases for drift, with a planned paid CI gate tier. Version 0.1 is an early scaffold requiring review before production use.", "body_md": "Design-time and audit agent for Postgres/Supabase **row-level security, CRUD permissions,\nand cascade-delete rules**. Write down who can select/insert/update/delete what, in plain\nYAML — rls-guard turns it into real SQL, and checks your live database against it.\n\nMisconfigured Row Level Security is currently one of the most common real-world data exposure bugs in Postgres/Supabase-backed apps. In one 2025 disclosure (CVE-2025-48757), 303 endpoints across 170 apps were found fully readable by anyone holding the public anon key, because RLS was off or misconfigured. This happens because RLS policies are easy to get subtly wrong and easy to forget entirely as a schema grows — especially in fast-moving, AI-assisted app builds.\n\nrls-guard exists so that:\n\n- You describe your permission model once, in a format a non-DBA can read and review.\n`rls-guard generate`\n\nturns that into an actual SQL migration (policies + cascade rules).`rls-guard audit`\n\nchecks a live database against the spec and flags drift — RLS disabled, overly permissive policies, cascade behavior that doesn't match intent.\n\n**v0.1 — early scaffold.** The core loop (spec → generate SQL, live DB → audit) works.\nNot yet battle-tested; review generated SQL before applying it to anything real. See\n`PLAN.md`\n\nfor what's next.\n\n```\nnpm install\ncp .env.example .env   # fill in ANTHROPIC_API_KEY and DATABASE_URL\nnpm run build\n```\n\nGenerate a migration from a spec (works with or without a live DB connection):\n\n```\nnpx tsx src/index.ts generate --spec spec/example.spec.yaml --out rls-guard.generated.sql\nnpx tsx src/index.ts generate --spec spec/example.spec.yaml --db $DATABASE_URL --out rls-guard.generated.sql\n```\n\nAudit a live database — fast deterministic checks always run; add `--spec`\n\nto also get a\nClaude-written comparison against your intended permission model:\n\n```\nnpx tsx src/index.ts audit --db $DATABASE_URL\nnpx tsx src/index.ts audit --db $DATABASE_URL --spec spec/example.spec.yaml\n```\n\nSee `spec/example.spec.yaml`\n\nfor the spec format: roles, per-table CRUD rules, and\ncascade-delete behavior (`cascade`\n\n/ `restrict`\n\n/ `set_null`\n\n).\n\nMost existing tools here are either general-purpose policy engines you write yourself\n(Open Policy Agent), heavyweight enterprise DB-access platforms, or external scanners\nthat probe a *live* app from outside without knowing what access was actually supposed\nto look like. rls-guard starts from your intended design (the spec) and both generates\nthe implementation and checks reality against that intent — closer to a linter + codegen\ntool than a black-box scanner.\n\n- CI mode: fail a PR/build when a new table has no RLS policy or a cascade rule drifts from spec (this is the planned paid tier — see below).\n- Prisma/Drizzle schema readers, not just live Postgres introspection.\n- Generated test suite (not just SQL) that proves unauthorized access actually fails.\n- Policy diffing between spec versions for change review.\n\nCore CLI is MIT-licensed and will stay free. The plan is an open-core model: a hosted CI gate + PR bot + compliance report generation as a paid tier on top of this free, inspectable core. GitHub Sponsors is on from day one regardless.\n\nEarly days — open an issue before a large PR. See `PLAN.md`\n\nfor the current build plan.", "url": "https://wpnews.pro/news/ls-guard-generate-and-audit-postgres-supabase-rls-from-a-spec", "canonical_source": "https://github.com/greyrow/rls-guard", "published_at": "2026-08-01 15:08:05+00:00", "updated_at": "2026-08-01 15:22:48.171252+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["rls-guard", "Postgres", "Supabase", "CVE-2025-48757", "Open Policy Agent", "Prisma", "Drizzle", "Anthropic"], "alternates": {"html": "https://wpnews.pro/news/ls-guard-generate-and-audit-postgres-supabase-rls-from-a-spec", "markdown": "https://wpnews.pro/news/ls-guard-generate-and-audit-postgres-supabase-rls-from-a-spec.md", "text": "https://wpnews.pro/news/ls-guard-generate-and-audit-postgres-supabase-rls-from-a-spec.txt", "jsonld": "https://wpnews.pro/news/ls-guard-generate-and-audit-postgres-supabase-rls-from-a-spec.jsonld"}}