Comparisons / CI scanners & AI reviewers
CodeQL queries code graphs; your policies live in Postgres
The short version
- CodeQL treats code as a queryable database of ASTs and dataflows — exceptional for vulnerability research in application code, bundled with GitHub Advanced Security. RowShield queries the actual Postgres catalog on a schedule.
- Choose CodeQL / GitHub Advanced Security when — organisations standardising GHAS across repositories for SAST and secret features.
- Choose RowShield when — Supabase-specific posture: policy semantics, anon behaviour, drift — none representable as repo queries.
RowShield rules relevant here
Head to head: CodeQL / GitHub Advanced Security vs RowShield
| Capability | CodeQL / GitHub Advanced Security | RowShield | Edge |
|---|---|---|---|
| Analytic substrate | Code extracted into a queryable relational snapshot per analysis run — powerful, and always a snapshot of text. | The live database itself, interrogated in place on schedule rather than reconstructed from files. | RowShield |
| Custom analysis | QL: a genuinely powerful query language with a specialised skillset few teams keep on staff. | Configurable thresholds over rules curated upstream — custom analysis is available but rarely required. | Parity |
| RLS awareness | No built-in semantics; bespoke QL approximates at best what migration files claim, never what the server applied. | Native coverage of tautologies, WITH CHECK gaps and deny-all states, judged against the applied catalog. | RowShield |
| Platform integration | Deeply GitHub-native: alerts land in the code-scanning UI beside the very lines they concern. | A standalone dashboard, CLI and alerts, with webhooks bridging to whatever chat or ticketing you already run. | CodeQL / GitHub Advanced Security |
| Secret scanning | Strong partner-integrated revocation flows across many credential types — broad where breadth matters. | One credential class done specifically: RLS-bypassing Supabase service keys sitting inside deployed bundles. | CodeQL / GitHub Advanced Security |
| Post-deploy visibility | None; analysis is commit-scoped by design, so out-of-band change does not exist as a concept for it. | The core loop itself: schedule, diff, classify, alert — deployed state treated as a first-class subject. | RowShield |
| Licensing model | GHAS enterprise licensing keyed to committer counts across the organisation. | Per-project plans above a functional free tier, so cost follows watched databases rather than headcount. | RowShield |
Column claims about CodeQL / GitHub Advanced Security are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What CodeQL does
CodeQL extracts repositories into relational databases of syntax and dataflow, letting analysts write QL queries that trace taint, match APIs, and encode vulnerability patterns with real rigour. Under GitHub Advanced Security it powers code scanning alerts natively beside secret scanning and dependency review.
The extraction step is the whole trick: analysis runs against a database built from your code, which is why results are reproducible and why the same machinery cannot reach a server it was never pointed at. Adoption rides on familiarity — alerts appear where engineers already review PRs.
For C/C++/Java/JavaScript vulnerability hunting it is among the best tools money can buy. The substrate, however, is always code.
Where the scopes differ
Database posture is not derivable from code: applied policies diverge from migrations, dashboards mutate state, and behaviour emerges from runtime configuration no extraction captures. A QL query over migration SQL can at best guess; the catalog knows.
Operational economics differ too — GHAS pricing assumes committer-scale adoption, while posture monitoring prices per project watched.
There is also a cadence mismatch worth naming. Analysis runs when analysis runs; posture degrades continuously between runs. Teams who standardised on GHAS still met incidents that no commit ever contained, and their conclusion was additive rather than replacement: keep the SAST estate, add an instrument whose unit of observation is the database itself.
Why Supabase teams choose RowShield over CodeQL
Fit and focus. Every finding maps to a Supabase failure mode with generated SQL fixes; scans continue when commits stop; and the free probe delivers the highest-value check — what the anon key can read — without any purchase at all.
Writing QL for posture is also a poor bargain even where possible: the query would describe migrations, not reality, and would need maintenance forever. RowShield's rules describe the catalog directly and are maintained upstream, so the skillset requirement drops to reading findings.
Where CodeQL is the right choice
If your threat model includes application-layer vulnerabilities and you are invested in GitHub, GHAS earns its keep across dozens of repos — taint tracing of that quality has no cheaper substitute, and nothing here disputes that lane.
The boundary is the substrate: no amount of code analysis observes a running database. Teams who respect the boundary buy once, correctly — GHAS for the application layer, RowShield scheduled against every environment that serves users — instead of stretching either tool past the edge of what it can see.
Using both
GHAS for the codebase, RowShield for the database layer: route webhooks from either into shared alerting, and let each own its substrate. The combination reads naturally in reviews too — code-scanning alerts stay attached to diffs they explain, while posture findings attach to environments they describe, and nobody has to translate one vocabulary into the other during an incident.
Frequently asked
- Is RowShield affiliated with GitHub?
- No. Veristria builds RowShield independently. CodeQL, GitHub Advanced Security and related marks belong to GitHub, Inc., and are referenced descriptively because GHAS is where many teams first meet serious automated analysis. Nothing here implies endorsement or partnership; descriptions rely exclusively on publicly documented behaviour. Nothing here should read as criticism of either product.
- Is RowShield a CodeQL alternative?
- Not for SAST — CodeQL is superb there and we recommend keeping it. As a substitute for bending QL toward database posture, emphatically yes: the catalog is not a code graph, and verification that targets deployments belongs to a tool whose observations target deployments, on schedule, with memory between runs.
- Does RowShield cover secret scanning?
- Narrowly and intentionally: scans detect exposed Supabase service keys in deployed client bundles, the one credential class that silently bypasses row level security. Broader secret programmes — history scanning, partner revocation, org-wide policies — pair naturally with dedicated scanners, and we would rather be honest about that boundary than vague about the coverage.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit