Is drift detection better than the Security Advisor?

Different axes. The advisor judges present state within its lint library; drift detection narrates change over time. Most serious projects benefit from both, and several advisor checks remain unique to it. Choosing one as a philosophy rather than a fit-for-stage decision causes familiar failures: unwatched change on fast projects. Ask what your schema velocity actually is before deciding what to lean on.

Does RowShield replace opening the advisor?

No — it replaces needing to remember to. Unique advisor coverage stays documented as such across this site rather than implied away. Opening the advisor remains worthwhile after significant changes precisely because its lens differs: it evaluates configuration against maintained lint knowledge rather than against yesterday. The two tools answering slightly different questions is the reason running both composes well.

What exactly counts as a transition?

Created: newly present. Resolved: previously present, now gone. Regressed: previously fixed, now returned. Retried scans produce none of these, keeping alerting idempotent. The three-word taxonomy exists because each word routes a different investigation: created asks whether new surface was intended, resolved confirms a fix landed, regressed starts a process conversation.

Which catches a Friday-afternoon policy drop?

Only the continuous side sees it before someone reopens the advisor: next scan flags the deletion as created drift, minutes to hours later depending on plan cadence. The advisor catches up the moment anyone opens it, which is exactly the contrast that matters: detection latency depends on attention versus schedule, and schedules hold better on Friday afternoons than intentions do.

Guides

Policy drift versus the advisor: point-in-time versus continuous

The Supabase Security Advisor and drift detection solve adjacent halves of one problem, and conflating them produces poor decisions in both directions. This page separates the concepts precisely, including what each genuinely covers. Getting the division right matters: teams who believe the advisor covers time stop watching for change; teams who believe drift monitoring replaces linting switch off a free lens nothing else replicates.

Transparency note, consistent with this cluster: drift diffing is RowShield product behaviour — scheduled snapshots, consecutive-run diffs, transition alerts — not one of the nine named rules. The advisor remains a good free tool this site consistently respects.

RowShield does not detect this yet. This guide gives you the catalog queries to check it yourself. The nine rules that do ship are listed on the rules index.

The advisor model: judge the present

Open the advisor and it evaluates current configuration against its lint library: RLS disabled, always-true policies, definer views, auth settings. Output is a verdict about now — comprehensive within its catalogue, authoritative, zero setup, vendor-maintained.

Its blind spot is temporal rather than analytical. Between two opens lies unbounded history: every migration, hotfix and revert. The advisor cannot say what changed since last time because it keeps no last time — by design, not defect. The consequence appears in retrospectives: opened today, it confirms today is sound and stays silent on whether Tuesday was, so teams holding only point-in-time evidence reconstruct change from memory and commit logs.

The drift model: narrate the delta

Drift detection inverts the question. Instead of "what is wrong", it answers "what moved": snapshots on schedule, consecutive diffs, classification — something appeared (created), something previously fixed returned (regressed), something cleared up (resolved). Classification runs against retained history rather than re-judgement of the present, which is why retries produce silence: unchanged state generates no transition, which keeps alerting idempotent.

The narrative quality carries operational weight. Regressed is blame-free signal that a fix failed upstream; created marks new surface; resolved closes loops with evidence. Three words replacing periodic re-reads of full inventories — which is the comparison teams actually experience week to week. The vocabulary also survives handoffs: a regressed finding links its original resolution date, so the engineer reading it at midnight knows this problem was fixed once already and where the previous fix lived.

Variations you will meet

Concrete scenarios show the seam clearly. A Friday-afternoon policy deletion sits invisible in the advisor’s blind window until someone reopens it on Monday; continuous scanning flags the disappearance within one cycle regardless of calendars. A recreated table arriving naked triggers both tools differently: the advisor reports the missing posture at next open, drift monitoring reports the recreation event itself with the timeline attached.

Restore regressions favour the continuous side almost entirely, because recognising a returned problem requires remembering it was solved. Novel misconfiguration categories run the other way: lint rules catch shapes drift has never seen before, while diffing needs one prior scan before transitions become speakable.

Choosing, honestly

Stable schemas with attentive owners need only the advisor — free, official, sufficient, and superior on several checks RowShield does not attempt. Fast-moving AI-assisted codebases need continuity, which is the entire thesis here: hourly-to-quarter-hourly cycles catching what between-visit intervals breed.

They compose, and most serious projects end up running both: advisor for its unique lens, drift monitoring for the time axis. Where the two disagree, investigate before dismissing either — configuration verdicts and behavioural probes fail in different ways, and disagreement itself is signal. Triage is cheap when both streams exist: check transition history for recent movement, reopen the advisor manually, and most apparent conflicts dissolve into timing differences rather than genuine contradiction.

Frequently asked

Is drift detection better than the Security Advisor?: Different axes. The advisor judges present state within its lint library; drift detection narrates change over time. Most serious projects benefit from both, and several advisor checks remain unique to it. Choosing one as a philosophy rather than a fit-for-stage decision causes familiar failures: unwatched change on fast projects. Ask what your schema velocity actually is before deciding what to lean on.
Does RowShield replace opening the advisor?: No — it replaces needing to remember to. Unique advisor coverage stays documented as such across this site rather than implied away. Opening the advisor remains worthwhile after significant changes precisely because its lens differs: it evaluates configuration against maintained lint knowledge rather than against yesterday. The two tools answering slightly different questions is the reason running both composes well.
What exactly counts as a transition?: Created: newly present. Resolved: previously present, now gone. Regressed: previously fixed, now returned. Retried scans produce none of these, keeping alerting idempotent. The three-word taxonomy exists because each word routes a different investigation: created asks whether new surface was intended, resolved confirms a fix landed, regressed starts a process conversation.
Which catches a Friday-afternoon policy drop?: Only the continuous side sees it before someone reopens the advisor: next scan flags the deletion as created drift, minutes to hours later depending on plan cadence. The advisor catches up the moment anyone opens it, which is exactly the contrast that matters: detection latency depends on attention versus schedule, and schedules hold better on Friday afternoons than intentions do.

Check your project in about ten seconds

Paste a URL. No signup, no writes, nothing stored.

Run the free audit