Comparisons / Schema diff & drift
RowShield vs Atlas: schema drift versus policy and behaviour drift
The short version
- Atlas, by Ariga, is a schema-as-code tool: declare the desired database state, and the CLI plans and applies changes, with `atlas schema diff` documenting drift detection between desired and live schemas. RowShield is a continuous monitor for Supabase that treats policy, storage and key exposure as the state worth watching.
- Choose Atlas when — your team wants declarative schema management with CI gates and drift reports for DDL across environments.
- Choose RowShield when — the DDL is already managed and you need to know whether authorisation held — whether any policy, bucket or key changed since the last verified scan.
RowShield rules relevant here
Head to head: Atlas vs RowShield
| Capability | Atlas | RowShield | Edge |
|---|---|---|---|
| Definition of drift | Desired schema versus live schema: structural deviation from the declared source of truth. | Verified posture versus previous posture: policy edits, bucket visibility, key exposure and readable anon surfaces. | RowShield |
| Change execution | Plans and applies migrations toward the declared state, with linting and CI integration. | Does not execute migrations; verifies the outcome whatever produced it. | Atlas |
| Policy semantics | Policies travel as objects in the schema definition; their meaning is not evaluated. | Conditions are evaluated: tautological USING clauses, absent WITH CHECK coverage, policies missing entirely. | RowShield |
| Behavioural verification | Works from declarations and catalogs; the HTTP surface is not exercised. | The probe requests the PostgREST surface as the anon role, GET only, and records results per table. | RowShield |
| Alerting between runs | Drift is reported when commands run in your pipeline or CI job. | Scheduled scans fire Slack, Discord, email and webhook alerts on transitions only. | RowShield |
| Supabase specificity | Engine-generic Postgres support; platform concepts like buckets and anon keys are out of frame. | Rules built for the Supabase stack, including storage exposure and service_role key detection in deployed bundles. | RowShield |
| Multi-engine and multi-environment reach | Broad database support and environment-as-code workflows — a real strength where DDL spans engines. | Postgres via Supabase only, deliberately. | Atlas |
Column claims about Atlas are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What Atlas does
Atlas implements schema-as-code: you describe the desired database state in HCL, SQL or an ORM schema, and the CLI diffs that declaration against the live database, plans the changes, and applies them. Its documentation describes `atlas schema diff` for comparing states and drift detection between the desired and actual schema, with linting and CI hooks so bad changes stop in the pipeline.
As change management it is coherent and well built. The unit of truth is structure: tables, columns, indexes, and the other objects the declarative model captures. When a policy appears in that model it travels as text attached to an object; whether that text authorises the world is outside the tool’s evaluation.
Where the scopes differ
Both products use the word drift, and the divergence is instructive. Atlas drift is deviation of structure from declaration: someone altered a column outside the pipeline and the next diff says so. That check is valuable, and it is blind to a second kind of drift entirely — deviation of behaviour from intent. A policy can match its declaration perfectly and still be wrong, if the declaration itself shipped with USING (true). Structure agreeing with the repo proves consistency, not safety.
RowShield defines drift over the properties that decide disclosure: policy existence and conditions (RLS_DISABLED, RLS_TAUTOLOGY), write-path coverage (MISSING_WITH_CHECK), storage visibility (PUBLIC_BUCKET_EXPOSURE), credential leakage (SERVICE_ROLE_KEY_EXPOSED), and observed behaviour (ANON_TABLE_READABLE via the GET-only probe).
Time also differs. Pipeline-integrated checks evaluate when pipelines run. Supabase projects change through dashboards, SQL editors and AI assistants that bypass every gate; RowShield scans on schedule precisely because the dangerous paths are the ones your CI never saw.
Why Supabase teams choose RowShield over Atlas
Teams arrive at Atlas to tame DDL chaos and stay because the pipeline feels safer. What remains unwatched is the authorisation layer: nothing in a schema-as-code flow notices that a fix regressed on Thursday night, that a bucket flipped public, or that the anon key now returns rows it should not. RowShield exists for exactly that interval.
Scans run up to every fifteen minutes on Team, diff against the prior snapshot, and classify every change as created, resolved or regressed. Alerts land where the team already lives. Remediation SQL arrives generated from your columns, FORCE ROW LEVEL SECURITY included. The free probe needs only a URL, so verification starts before any purchase conversation.
Where Atlas is the right choice
If you operate many databases across engines and want declarative management, reviewable migration plans and CI enforcement for DDL, Atlas is a serious tool for a serious job, and RowShield offers nothing comparable — we do not manage schema, we audit outcomes.
Platform teams standardising delivery across MySQL, Postgres and beyond get more from that breadth than from any Supabase-specific monitor.
Using both
This is the composition we recommend most in this tier: Atlas owns desired-state DDL and catches structural drift in the pipeline; RowShield owns the authorisation and behaviour layer between deploys, where dashboards and AI-generated SQL make their changes.
RowShield reads pg_catalog metadata only and is built by Veristria, independent of Ariga Technologies Ltd.; Atlas is referenced descriptively and remains a trademark of its owner.
Frequently asked
- Is RowShield affiliated with Ariga or Atlas?
- No. RowShield is built by Veristria, an independent company, and is neither endorsed by nor affiliated with Ariga Technologies Ltd. Atlas is referenced descriptively based on its public documentation.
- Is RowShield a good Atlas alternative?
- For declarative schema management and applying migrations, no — Atlas is purpose-built and we recommend it for that job. For continuous verification of policy, storage and behaviour on Supabase, yes: RowShield monitors the layer Atlas treats as opaque text.
- We already catch drift in CI with Atlas lint. Is that enough?
- It covers structural drift that passes through the pipeline. Changes made through the Supabase dashboard, SQL editor or generated by AI tools bypass CI entirely, and policy correctness is not a lint dimension. Continuous scanning closes both gaps.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit