Comparisons / Uptime monitors
RowShield vs Cronitor: job heartbeats versus permission posture
The short version
- Cronitor masters scheduled-work accountability: heartbeats, uptime pings, and job telemetry that make silent failures loud within minutes. RowShield monitors a different silence entirely: permissive Supabase policies leaking data nightly while every job pings home successfully.
- Choose Cronitor when — scheduled tasks, background workers, and cron reliability form your observability gap, and lightweight heartbeat instrumentation fits your workflow.
- Choose RowShield when — you need supervision of authorisation between and beneath your jobs: continuous RLS verification, anonymous-path probes, and key-exposure alerts tailored to Supabase.
RowShield rules relevant here
Head to head: Cronitor vs RowShield
| Capability | Cronitor | RowShield | Edge |
|---|---|---|---|
| Object of observation | Task execution: whether scheduled jobs start, finish, and ping within expectations, with telemetry around each run. | Permission state: what anonymous callers can retrieve from each connected Supabase project, sampled continuously between releases. | RowShield |
| Failure philosophy | Missing-heartbeat detection: absence of the expected ping is the canonical signal, elegantly simple and effective for jobs. | Silent-leak detection: the gravest failures emit no errors, so verification must interrogate outcomes rather than await exceptions. | Parity |
| Nightly SQL ping ceiling | Definitional limit: success criteria are binary completion signals, agnostic to what queries actually returned. | Surpassed: beyond liveness, probes judge whether query results respect policy, parsing semantics a ping cannot express. | RowShield |
| Instrumentation burden | Deliberate minimalism: embed ping URLs or CLI wrappers in jobs, touching code and deployment habits slightly. | Zero-code: projects connect externally with no SDK calls, ping URLs, or wrappers woven through your codebase. | RowShield |
| Scope honesty | Focused-but-wider: job and uptime monitoring across stacks, with Supabase as one hostable target among many. | Single-minded: Supabase authorisation and key exposure, nothing else, executed with corresponding depth. | Parity |
| Team fit | Platform and SRE folks herding distributed schedulers, queues, and background workers across services. | Application and security engineers reviewing exposure reports alongside migrations they shipped this week. | Cronitor |
Column claims about Cronitor are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What Cronitor does
Cronitor answers an old question freshly: did the thing that should have run actually run? Jobs report heartbeats, missing pings trigger alerts, and telemetry records duration plus failures. Uptime checks extend coverage to endpoints and sites.
Its virtue is restraint: lightweight instrumentation, clear alerts, and pricing that encourages sprinkling observability across every script deserving supervision. For cron reliability specifically it has few peers, and this page happily concedes that ground.
Where the scopes differ
Job monitoring celebrates completion; authorisation monitoring distrusts it. A nightly export succeeding while its source table leaks to anonymous readers is, to Cronitor, flawless operation. Conversely RowShield ignores whether tasks ran at all, caring only what permissions allowed meanwhile.
The nightly SQL ping, a beloved crutch, proves connectivity and never correctness: a wide-open table returns cheerfully for years while heartbeats stay green. Three-lens check: posture, untested by pings by definition; behaviour, unexercised because success signals carry no payload judgement; drift, invisible unless a job happens to fail loudly rather than leak quietly.
Different silences require different instruments, which is why the two products coexist peacefully in the same monitoring stack.
Why Supabase teams choose RowShield over Cronitor
Because their anxiety is disclosure, not dormancy. RowShield probes the public API as an anonymous stranger would, distinguishes filtered from empty responses, flags service keys riding in shipped bundles under SERVICE_ROLE_KEY_EXPOSED, and archives policy drift between deploys.
Cronitor cannot pose those questions by design, no matter how carefully configured. Teams keep Cronitor supervising workers and schedules happily while RowShield closes the permission blind spot heartbeat dashboards never knew existed, each priced fairly for its half.
Where Cronitor is the right choice
For cron reliability, queue consumers, and heartbeat-style liveness anywhere, Cronitor is a delight and deserves its following, conceded completely. Scheduled-task assurance is a real discipline and they practise it well.
The pivot: scheduled-task assurance sometimes gets mistaken for database assurance because both appear in the same mental drawer. They differ fundamentally. Let Cronitor own the former; hand RowShield the latter for every Supabase project facing the internet.
Using both
Instrument jobs with Cronitor heartbeats so silence alerts loudly; connect projects to RowShield so permissiveness alerts quietly but surely. Shared alert channels keep both visible, tagged by kind for the right responder.
During incident reviews the pair tells a complete story: what failed to run, and what ran successfully while permissions quietly drifted, narratives neither tool can construct alone.
Frequently asked
- Is RowShield affiliated with Cronitor?
- No. RowShield is developed independently by Veristria and is neither endorsed by nor affiliated with Cronitor. Cronitor is a product of its own company, described here strictly from publicly available information.
- Can I use both together?
- Yes. Cronitor supervises execution through heartbeats and pings; RowShield supervises authorisation through probing. Use each for its native question and the combination covers both silence and exposure without overlap.
- We already ping our database nightly, so is that covered?
- Only for liveness. A successful ping demonstrates connectivity, saying nothing about which rows anonymous callers may read; policy failures return cheerfully for years unnoticed. RowShield exists precisely because that silence misleads excellent teams.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit