Comparisons / Migration frameworks
RowShield vs dbmate: plain SQL migrations versus live monitoring
The short version
- dbmate is a minimalist, language-agnostic migration tool: numbered .sql files with up/down sections, applied by a single binary. RowShield is a scheduled Supabase monitor that verifies the authorisation outcome of whatever applied those files — policies, buckets, keys, and what the anon key can actually fetch.
- Choose dbmate when — you want dependency-free SQL migrations driven from Makefiles, Docker or anywhere a binary runs.
- Choose RowShield when — the files contain policy surgery and you want scheduled proof it stayed correct — nine rules, a GET-only probe, and alerts labelled created, resolved or regressed.
RowShield rules relevant here
Head to head: dbmate vs RowShield
| Capability | dbmate | RowShield | Edge |
|---|---|---|---|
| Applying change | Executes pending .sql files against the target database and records versions. | Never applies migrations; audits the resulting state regardless of origin. | dbmate |
| Reviewing outcome | Success is measured by statements executing without error. | Success is measured by posture: RLS enabled, policies sane, writes guarded, buckets closed. | RowShield |
| Policy semantics | SQL passes through verbatim; USING (true) migrates as smoothly as a correct predicate. | Constant-true conditions, missing policies and absent WITH CHECK clauses detected per scan. | RowShield |
| Ongoing supervision | A run-time tool: between invocations nothing observes the database. | Scans from every fifteen minutes to daily, each diffed against the previous snapshot. | RowShield |
| Behavioural probe | Absent by design; no requests touch the serving layer. | PostgREST queried as the anon role, GET only, with readable tables reported per scan. | RowShield |
| Notifications | Exit codes and console output for whoever ran it. | Slack, Discord, email and webhooks with severity thresholds, transitions only. | RowShield |
| Minimalism | One static binary, zero dependencies — a virtue in its category. | More surface than a binary, deliberately. | dbmate |
Column claims about dbmate are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What dbmate does
dbmate, per its README reviewed 2026-08-23, is a framework-agnostic migration tool distributed as a single binary: migrations are plain SQL files with paired up and down sections, applied in order and tracked by a schema_migrations table. It waits for the database to become ready, supports URLs as targets, and fits neatly into Makefiles, Docker entrypoints and CI scripts.
Its philosophy is visible in the feature list — small, sharp, done. That minimalism is exactly right for applying files, and exactly silent about consequences: whether the applied SQL strengthened or gutted authorisation is not a question the tool poses.
Where the scopes differ
dbmate’s contract ends when statements execute; RowShield’s begins there. The distinction bites wherever migration files touch Supabase’s authorisation objects. A file that drops and recreates a table executes cleanly and leaves the table unprotected; a file rewriting a policy to USING (true) executes equally cleanly. In both cases dbmate reports success because its success criterion — error-free execution — is genuinely satisfied.
Monitoring reframes the criterion. Each RowShield scan reads the live catalog and asks the security questions directly: RLS_DISABLED, RLS_NO_POLICIES, RLS_TAUTOLOGY, MISSING_WITH_CHECK, PUBLIC_BUCKET_EXPOSURE, SERVICE_ROLE_KEY_EXPOSED. The probe then asks the behavioural one, requesting PostgREST as the anonymous role and recording which tables yield rows.
Time separates them last. A binary runs when summoned; leaks occur between summonses — the weekend hotfix, the AI-suggested snippet pasted into the dashboard. Scheduled scans convert those blind intervals into observations, and the snapshot history turns a returned problem into an explicitly labelled regression.
Why Supabase teams choose RowShield over dbmate
Nobody abandons dbmate for us; they add us because the two contracts complete each other. The free probe answers "can strangers read my tables today?" from a URL alone, in minutes. Full monitoring on a paid plan adds the nine-rule catalogue on a schedule, remediation SQL generated from your columns with FORCE ROW LEVEL SECURITY, and transition-only alerts to Slack, Discord, email or webhooks.
For teams scripting policy changes into .sql files, the value is concrete: the file that worked in staging but regressed production posture is caught by the next scan, not by the first support ticket. The CLI reproduces every check with CI-safe exit codes where you want a gate.
Where dbmate is the right choice
If you want migrations without adopting a framework — polyglot repos, container entrypoints, teaching examples — dbmate’s single-binary plainness is the appeal and it delivers exactly what it promises. RowShield applies no migrations and offers no substitute for that role.
Tiny projects with static schemas may also find any monitoring surplus; the free probe remains available if that calculus changes.
Using both
dbmate moves the schema; RowShield watches what moved. Keep the Makefile target; add the scheduled scan so the authorisation consequences of every applied file are observed without anyone remembering to look.
RowShield reads pg_catalog metadata only and is built by Veristria, unaffiliated with the dbmate maintainers; the project is referenced descriptively as open-source software.
Frequently asked
- Is RowShield affiliated with the dbmate project?
- No. RowShield is built by Veristria, an independent company, and is neither endorsed by nor affiliated with the maintainers of dbmate, which is referenced descriptively as an open-source tool.
- Is RowShield a good dbmate alternative?
- For applying plain SQL migration files, no — dbmate is a fine minimal choice and should keep that job. For continuously verifying the authorisation state those files leave behind on Supabase, yes: monitoring is the missing layer, and RowShield provides it.
- Can RowShield run in CI alongside dbmate migrations?
- Yes. The CLI performs the same checks with exit codes suitable for pipelines, so a common pattern is dbmate applying migrations followed by a RowShield gate asserting the posture you expect.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit