Comparisons / Migration frameworks
RowShield vs Drizzle Kit: fast pushes versus continuous checks
The short version
- Drizzle Kit drives schema workflow for the Drizzle ORM: drizzle-kit generate creates migration files from schema changes and push applies a computed diff straight to the database. RowShield is a continuous Supabase monitor that checks the authorisation layer those workflows never touch — policies, storage, keys — and alerts when it moves.
- Choose Drizzle Kit when — you want the quickest possible schema iteration loop in TypeScript and accept that speed is the feature.
- Choose RowShield when — AI-assisted pushes land daily and you want an automated verdict on whether the project still refuses anonymous reads — within minutes, not at the next incident.
RowShield rules relevant here
Head to head: Drizzle Kit vs RowShield
| Capability | Drizzle Kit | RowShield | Edge |
|---|---|---|---|
| Workflow speed | Push computes and applies a diff in seconds — the headline convenience. | Scans run on schedule up to every fifteen minutes; verification is automatic rather than invoked. | Parity |
| Scope of the diff | Schema objects expressible in the Drizzle schema: tables, columns, indexes, relations. | Full authorisation posture: RLS flags, policy conditions, WITH CHECK coverage, buckets, keys. | RowShield |
| Policy handling | Policies are outside the schema vocabulary; SQL escapes handle them informally. | First-class rules: RLS_TAUTOLOGY reads conditions, MISSING_WITH_CHECK inspects write guards. | RowShield |
| Post-change verification | The workflow ends when the push succeeds. | Verification begins there: each scan probes PostgREST as anon (GET only) and diffs posture against last scan. | RowShield |
| Regression memory | Stateless between commands. | Snapshot history classifies every change created, resolved or regressed, so reverted fixes announce themselves. | RowShield |
| Alerting surface | Console output at invocation time. | Slack, Discord, email and webhook alerts with severity thresholds, fired only on transitions. | RowShield |
| Fit inside TS dev loops | Excellent: one toolchain from schema file to applied database. | External by design; dashboard and CLI complement the loop without joining it. | Drizzle Kit |
Column claims about Drizzle Kit are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What Drizzle Kit does
Drizzle Kit is the companion CLI to the Drizzle ORM, popular in TypeScript and AI-generated codebases. Per its documentation, reviewed 2026-08-23, drizzle-kit generate derives migration files from changes to your schema definitions, and drizzle-kit push computes a diff and applies it to the database directly, skipping intermediate files when wanted. Iteration speed is the explicit selling point: change the schema, push, keep building.
The workflow’s brevity is also its boundary. The schema definitions describe relational structure; row level security, storage rules and platform credentials are not part of that vocabulary, so the push that recreates a table in four seconds carries no notion of the policies that vanished with it.
Where the scopes differ
Speed changes the risk profile rather than reducing it. Push lowers the cost of a schema change to near zero, which multiplies how often changes happen — including changes suggested by coding assistants and accepted quickly. Each individual push is small; the aggregate effect is that the authorisation layer gets rewritten far more often than anyone reviews it. A tool that ends its concern at successful application leaves exactly that layer unobserved.
RowShield picks up where the push stops: scheduled scans read the live catalog and evaluate what the ORM never modelled — whether RLS remained enabled (RLS_DISABLED), whether recreated policies came back sane (RLS_TAUTOLOGY, RLS_NO_POLICIES), whether write paths kept their guards (MISSING_WITH_CHECK), whether buckets stayed private (PUBLIC_BUCKET_EXPOSURE).
Then behaviour: the probe requests PostgREST as the anonymous role, GET only, so the verdict reflects what an actual visitor experiences rather than what the schema implies. Because snapshots persist, the fix that quietly reverts next sprint is labelled a regression instead of passing unnoticed.
Why Supabase teams choose RowShield over Drizzle Kit
Nothing here argues against push; it argues for pairing it with consequence-checking. RowShield attaches to the same project in minutes — URL alone for the free probe, read-only connection string on a paid plan for scheduled monitoring — and turns "did that push break anything?" from a memory test into a notification.
The nine-rule catalogue is Supabase-specific down to service_role key detection in deployed frontend bundles, a leak class no schema tool can see. Findings ship with remediation SQL generated from your columns, FORCE ROW LEVEL SECURITY included, and the CLI reproduces every check with CI-friendly exit codes for teams gating pushes automatically.
Where Drizzle Kit is the right choice
For TypeScript teams bought into Drizzle, the kit is the natural schema tool: fast, close to the code, and pleasant enough that schema hygiene actually happens. We would not trade that away, and RowShield offers no migration generation at all.
Prototypes and throwaway builds may reasonably accept the unmonitored tradeoff for a while — the honest cut-off is when strangers could plausibly find the project.
Using both
Push as often as you like; RowShield re-verifies the protection layer on schedule afterwards, catching the dropped policy or flipped bucket that a fast loop invites. Velocity and verification compose — that is the whole recommendation.
RowShield reads pg_catalog metadata only and is built by Veristria, independent of the Drizzle Team; Drizzle Kit is referenced descriptively as an open-source tool.
Frequently asked
- Is RowShield affiliated with the Drizzle team?
- No. RowShield is built by Veristria, an independent company, and is neither endorsed by nor affiliated with the maintainers of Drizzle and Drizzle Kit, which are referenced descriptively as open-source projects.
- Is RowShield a good Drizzle Kit alternative?
- For generating and applying schema diffs in a TypeScript loop, no — Drizzle Kit does that well and belongs in your workflow. For continuous verification of Supabase policies, storage and behaviour after those pushes, yes: RowShield automates the check the push workflow leaves undone.
- We use drizzle-kit push constantly. Does that interfere with scanning?
- No. Scans read catalog metadata and probe the public surface independently of how schema changes arrive. Frequent pushes simply mean frequent diffs, each classified so churn stays legible.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit