Comparisons / Schema diff & drift
RowShield vs apgdiff: dump comparison versus live monitoring
The short version
- apgdiff is a long-running open-source Java utility that reads two PostgreSQL dump files and prints the DDL statements needed to turn the first schema into the second. RowShield is a hosted monitor that scans a live Supabase project on a schedule, checks nine authorisation rules, probes the anon surface, and alerts when anything changes.
- Choose apgdiff when — you occasionally need a quick textual diff of two schemas taken offline, and a Java jar on the workstation suits your habits.
- Choose RowShield when — the question is continuous — is the deployed project still private? — and you want transitions alerted, not recomputed by hand whenever someone remembers.
RowShield rules relevant here
Head to head: apgdiff vs RowShield
| Capability | apgdiff | RowShield | Edge |
|---|---|---|---|
| Required input | Two pg_dump schema files you supply, compared offline. | Your live project: catalog metadata read directly each scheduled scan. | RowShield |
| Output artifact | DDL statements representing the structural difference between the dumps. | Rule findings with severities, diffs against the prior scan, and remediation SQL per finding. | RowShield |
| Schedule and memory | Manual invocation; no state persists between runs. | Every fifteen minutes to daily by plan, with full history of posture changes. | RowShield |
| Security semantics | Structural comparison; policy text is not evaluated for meaning. | Constant-true conditions, missing WITH CHECK clauses and disabled RLS detected explicitly. | RowShield |
| Behavioural probe | None: files in, text out; no requests ever leave your machine toward the service. | GET-only probe against PostgREST as the anon role, reporting per-table readability. | RowShield |
| Alerting | You read the output when you run it. | Slack, Discord, email and webhook alerts fired on created/resolved/regressed transitions. | RowShield |
| Simplicity and cost | Free, tiny, zero accounts — genuinely convenient for an occasional offline diff. | Free probe available, monitoring on a paid plan; more moving parts than a jar. | apgdiff |
Column claims about apgdiff are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What apgdiff does
apgdiff has existed for years as a focused utility: feed it two PostgreSQL dump files and it emits the DDL that would upgrade one schema to the other. Its homepage describes exactly that contract — compare dumps, print differences — and the tool’s restraint is its virtue: no agents, no services, no accounts, just a comparison when asked.
It fits occasional work: checking what changed between a colleague’s branch database and yours, or reconstructing upgrade SQL from two snapshots. As a workflow, it depends entirely on someone choosing to run it and reading what comes back.
Where the scopes differ
apgdiff compares representations of schemas; RowShield supervises a running system. The practical differences follow from that. First, freshness: a dump is a photograph of some past moment, and the diff is only as current as the last time someone took two of them. Supabase projects change through dashboards and AI-assisted SQL between photographs, so the interesting event usually happens off-camera. Scheduled scans keep the camera rolling.
Second, interpretation. A structural diff reports that a policy line differs; it cannot say the new condition is USING (true), or that an UPDATE path lost its WITH CHECK, because meaning is not its unit of analysis. RowShield’s rules exist to read that meaning — RLS_TAUTOLOGY, MISSING_WITH_CHECK, RLS_NO_POLICIES — and to attach severities.
Third, the layer beneath structure. Whether the anon key retrieves rows is decided by PostgREST per request, invisible to any pair of dumps. Only a probe that behaves like a visitor answers it, and RowShield issues those GET requests every scan.
Why Supabase teams choose RowShield over apgdiff
The searcher comparing these two is really choosing between a snapshot ritual and a smoke alarm. Rituals fail quietly: the week everyone is busy is the week a fix regresses. RowShield replaces recall with schedule — scans from every fifteen minutes to daily, snapshots diffed automatically, changes classified created, resolved or regressed, and alerts routed to Slack, Discord, email or webhooks only when something actually moved.
The checks come tuned for Supabase out of the box, including PUBLIC_BUCKET_EXPOSURE and SERVICE_ROLE_KEY_EXPOSED that no dump-differ contemplates. Remediation SQL is generated from your columns with FORCE ROW LEVEL SECURITY, and the free probe starts with nothing but a project URL.
Where apgdiff is the right choice
For an occasional, offline, dependency-light comparison of two schemas, apgdiff is entirely adequate and free, and we would not talk anyone out of keeping it in a toolbox for exactly that errand.
Air-gapped environments and quick pre-upgrade sanity checks suit it well; there is nothing here to deploy.
Using both
Keep apgdiff for ad-hoc structural archaeology; rely on RowShield for everything time-sensitive. One answers "what differs between these two files"; the other answers "what changed in my project since yesterday, and does any of it expose data".
RowShield reads pg_catalog metadata only and is built by Veristria, unaffiliated with the apgdiff maintainers; the project is referenced descriptively.
Frequently asked
- Is RowShield affiliated with the apgdiff project?
- No. RowShield is built by Veristria, an independent company, and is neither endorsed by nor affiliated with the maintainers of apgdiff, which is referenced descriptively as an open-source utility.
- Is RowShield a good apgdiff alternative?
- For printing DDL differences between two dump files, no — a small dedicated tool does that well and costs nothing. For scheduled monitoring of a live Supabase project’s authorisation posture and behaviour, yes: that capability class is absent from offline diff utilities entirely.
- Can RowShield tell me what changed between two dates?
- Yes. Every scan stores a snapshot, and findings are classified against the previous one, so the dashboard shows created, resolved and regressed items over time rather than a single undifferentiated list.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit