Comparisons / Schema diff & drift
RowShield vs Liquibase: changelogs versus continuous policy checks
The short version
- Liquibase tracks database change through changelogs — declarative files applied in order — with paid tiers documenting drift detection that compares changelog expectations to the live database. RowShield is a continuous monitor for Supabase whose drift subject is authorisation: policies, storage, keys and observed anon behaviour.
- Choose Liquibase when — your organisation standardises database delivery around changelogs and needs structured rollouts across engines and environments.
- Choose RowShield when — you need to know whether this week’s changes kept the project private — checked on a schedule, alerted on transitions, with no changelog discipline required first.
RowShield rules relevant here
Head to head: Liquibase vs RowShield
| Capability | Liquibase | RowShield | Edge |
|---|---|---|---|
| Unit of change | Changelog entries in XML/YAML/JSON/SQL, applied and tracked in order by the Liquibase runner. | Catalog snapshots: each scan captures posture wholesale, independent of how changes arrived. | Parity |
| Drift detection | Documented in paid tiers: compares expected state from the changelog history against the live database. | Every scan diffs the full snapshot — including changes made outside any pipeline, such as dashboard edits. | RowShield |
| Subject of the drift check | Structural objects recorded in changelog history. | Authorisation state: RLS flags, policy conditions, WITH CHECK coverage, buckets, key exposure. | RowShield |
| Semantic policy analysis | Out of scope: changelogs record what was applied, not what a policy authorises. | RLS_TAUTOLOGY detects constant-true conditions; MISSING_WITH_CHECK finds unguarded write paths per table and role. | RowShield |
| Behavioural verification | No requests are issued to the application surface. | The probe calls PostgREST as the anon role, GET only, and records ANON_TABLE_READABLE results. | RowShield |
| Cost of the drift capability | Paid tiers document drift detection; the entry editions focus on core changelog execution. | Posture checks run on every plan without a paid tier, and the Free plan never withholds findings. | RowShield |
| Maturity for structured enterprise delivery | Decades-long track record in changelog-based delivery across engines. | Younger product scoped to one stack. | Liquibase |
Column claims about Liquibase are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What Liquibase does
Liquibase organises database change as an ordered changelog: modifications written in XML, YAML, JSON or plain SQL are applied in sequence by the runner, which records what has been applied to each database. Its documentation and site describe structured deployment flows across many engines, with the commercial editions adding capabilities beyond the open-source core — drift detection among them, phrased here carefully as documented on paid tiers rather than transcribed from any pricing page.
As delivery machinery it works, and enterprises trust it with thousands of databases. The model’s assumption is that change flows through the runner: what the changelog says was applied becomes the expectation against which reality is compared.
Where the scopes differ
Two gaps open between that model and Supabase reality. The first is provenance: much of what changes a Supabase project never touches your changelog — policies edited in the dashboard, buckets toggled in storage settings, SQL pasted into the editor by an AI assistant’s suggestion. Changelog-vs-live drift checks measure fidelity to the pipeline; they cannot see changes that bypassed it. RowShield snapshots the live catalog every scan, so provenance is irrelevant: dashboard edit or migration file, the next scan sees the result.
The second is subject. Even a perfect changelog drift check answers "does the database match what I said I would do". It does not ask "was what I said I would do safe". A changelog entry creating a policy with USING (true) reconciles exactly with a database carrying USING (true) — zero drift reported, world readable anyway. Semantic checks (RLS_TAUTOLOGY, MISSING_WITH_CHECK) and the behaviour probe exist because reconciliation and safety are different properties.
Liquibase’s own framing serves general databases; Supabase-specific surfaces — anon/service_role keys, storage, PostgREST — sit outside its vocabulary by design, not by fault.
Why Supabase teams choose RowShield over Liquibase
Because the searcher typing "liquibase drift detection" usually wants reassurance, not reconciliation: proof that the project is still closed to anonymous readers. RowShield gives it without demanding changelog adoption first — point the free probe at your URL and the first behavioural answer arrives immediately; add a connection string for full catalog monitoring on a paid plan.
Nine rules cover the Supabase failure modes specifically: disabled RLS, tautological and missing policies, unguarded writes, public buckets, leaked service_role keys, readable anon tables. Scans run up to every fifteen minutes, alerts fire on transitions only, and every finding ships with generated remediation SQL. Nothing is withheld on Free.
Where Liquibase is the right choice
Enterprises running structured, auditable database delivery across engines and hundreds of instances are Liquibase’s home ground, and its longevity there is earned. If changelog governance is your mandate, adopt it — RowShield does not execute or version schema change at all.
Polyglot estates needing one delivery format for Oracle, SQL Server and Postgres alike have no reason to look here.
Using both
They divide cleanly: Liquibase structures and records what you intend to change; RowShield continuously verifies what the live Supabase project actually allows, catching the dashboard edits and AI-generated SQL that never entered a changelog.
RowShield reads pg_catalog metadata only and is built by Veristria, independent of Liquibase, Inc.; Liquibase is referenced descriptively and remains a trademark of its owner.
Frequently asked
- Is RowShield affiliated with Liquibase?
- No. RowShield is built by Veristria, an independent company, and is neither endorsed by nor affiliated with Liquibase, Inc. Liquibase is referenced descriptively; edition capabilities are described conservatively and linked rather than priced here.
- Is RowShield a good Liquibase alternative?
- For changelog-driven delivery across engines, no — Liquibase remains a strong choice and pricing is best read on their site. For continuous Supabase-focused drift detection over policy, storage and behaviour, yes: RowShield monitors what changelog tooling never observes.
- Changes to my Supabase project happen outside Liquibase. Will RowShield see them?
- Yes. Scans snapshot the live catalog directly, so changes from dashboards, SQL editors, AI tools or manual psql sessions all appear in the next scan’s diff regardless of how they were made.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit