Planned work, stated honestly
This page lists the work we have committed to in direction, ordered roughly by how soon we expect to start rather than by promise.
What it deliberately omits is dates. Public estimates tend to become fiction under pressure, so instead of dates we offer specificity about what each item will and will not do, updated as reality teaches us more. Items move, merge or occasionally get dropped, and this page records that honestly.
GitHub Action integration
Scanning belongs in the pull request, not in a dashboard someone remembers to visit. The planned action wraps the CLI so a workflow step runs the same nine rules against a target project and annotates the pull request with any regressions: policies weakened, row security dropped, buckets opened wide.
Failing the build on regressions is opt-in per rule, because teams differ on what should block a merge. Credentials live in your runner as repository secrets and are never transmitted to us; the action performs its scan directly and posts only verdict summaries.
Public scan API
A documented, rate-limited API that accepts a project reference with an anon key and returns the machine-readable verdict the dashboard renders: per-table posture, observed row counts, storage listing and rule outcomes. Responses are stable, versioned JSON designed for consumption by other tools rather than by people.
Idempotency keys make retries safe, and the same evidence standard as interactive scans applies throughout. This precedes deeper third-party integrations, because a solid API is the honest foundation for everything else that wants to build on the results.
Security definer analysis candidates
The dashboard advisor is ahead of us on definer functions today, as the conflicts article concedes plainly. Closing that gap means parsing function bodies and reasoning about them: mutable search paths that invite object shadowing, unqualified references that resolve differently than their author assumed, and owner-rights paths that expose more than the function's purpose requires.
Output will begin as a candidate list — findings worth human review, ranked and evidenced — rather than automatic verdicts, because static analysis of programs deserves humility. Early drafts of the candidate heuristics will be shared for comment before they influence any score.
Related
Did this answer your question? If not, tell us what is missing — article corrections go straight to the person who maintains it.