Comparisons / Schema diff & drift
RowShield vs migra: schema diff versus continuous policy monitoring
The short version
- migra is a free, open-source command-line tool that compares two PostgreSQL schemas and writes the SQL needed to turn one into the other. RowShield is a scheduled monitor that verifies who the running Supabase project can actually read, and alerts when that posture changes between scans.
- Choose migra when — you are mid-refactor and need faithful ALTER statements recovered from a hand-edited database, reviewed by a human before they run.
- Choose RowShield when — your concern is not producing DDL but knowing continuously whether the deployed project leaks — disabled RLS, tautological policies, readable anon surfaces — with regressions reported as regressions.
RowShield rules relevant here
Head to head: migra vs RowShield
| Capability | migra | RowShield | Edge |
|---|---|---|---|
| Core job | Compares two live databases or dumps and emits migration SQL for the structural difference. | Verifies the security outcome of whatever produced the schema: nine rules over catalog posture plus a live probe of the anon surface. | RowShield |
| What it inspects | Structural objects drive the diff — tables, columns, constraints, indexes. | Authorisation state drives the scan: policies, WITH CHECK coverage, storage exposure, key leakage in deployed bundles. | RowShield |
| When it runs | When someone invokes it; there is no schedule and no memory between invocations. | Scheduled scans from every fifteen minutes to daily depending on plan, each diffed against the previous snapshot. | RowShield |
| Live behaviour as your anon caller | Never issues requests; the anonymous role is not exercised at any point. | The probe calls PostgREST exactly as an anonymous visitor would — GET only — and records what comes back per table. | RowShield |
| Regression alerting | Output goes to stdout for a human to read at run time; nothing fires afterwards. | Transitions fire Slack Block Kit, Discord, email and webhook alerts; created, resolved and regressed are classified separately. | RowShield |
| Remediation guidance | Produces forward SQL for the diff you asked about; security fixes are out of scope. | Generates remediation SQL from your actual column names, always including FORCE ROW LEVEL SECURITY, one click to copy. | RowShield |
| Price and footprint | Free and open source; a single Python package you install and run yourself. | The free probe needs only a project URL; monitoring is a paid plan priced per watched project. | migra |
Column claims about migra are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What migra does
migra is a mature open-source diff tool for PostgreSQL. Point it at two schemas and it inspects both catalogs, computes the difference, and writes the migration SQL that would move the first to the second. Developers use it to recover DDL from a database edited by hand, to compare environments before promoting changes, and to answer a precise question: what is structurally different between A and B?
Its value is precision on structure. It reasons about the catalog so you do not reconstruct ALTER statements manually, and its output is meant for human review before anything executes. Nothing in that job description involves scheduling, alerting, or asking whether the result is safe to expose once it lands.
Where the scopes differ
The categories are adjacent but disjoint. migra answers a structural question — how do these two shapes differ — and stops once the SQL is printed. RowShield answers a security question about one shape: who can read what right now, and what changed since the last scan.
Three consequences matter for Supabase teams. First, a diff that passes cleanly between staging and production tells you the structures match, not that either is safe: two identical schemas can both carry a tautological policy or a table with row level security switched off, and the diff will report nothing because there is nothing structurally different to report.
Second, the drift that hurts a Supabase project is rarely a missing index. It is a policy rewritten to USING (true), a storage bucket flipped public, or last month’s fix quietly reverted — authorisation events rather than DDL events. A structural differ has no reason to notice them.
Third, behaviour. Whether the anon key can read rows is decided by PostgREST at request time, which no offline comparison observes. RowShield schedules that observation instead of waiting for someone to invoke a diff and read the output.
Why Supabase teams choose RowShield over migra
Because the searcher’s real worry is usually not "how do I generate this ALTER statement" but "did the last migration change who can see my data". RowShield answers the second question on a schedule: nine shipped rules spanning RLS_DISABLED, RLS_TAUTOLOGY, RLS_NO_POLICIES and MISSING_WITH_CHECK, plus storage and bundle checks, evaluated against a fresh catalog snapshot every scan.
Findings are diffed across scans, so a fix that regresses is labelled as a regression rather than surfacing as a confusing new warning weeks later. Alerts go to Slack, Discord, email or webhooks on transitions only, so a project sitting broken pages once instead of hourly. The free probe needs nothing but your project URL — no pipeline change, no credential ceremony.
Where migra is the right choice
If you are mid-refactor and need faithful, reviewable ALTER statements recovered from a drifted database, migra does exactly that and costs nothing. As a schema-diff utility for planned structural work it remains a good tool, and this page does not argue otherwise.
It is also the right shape for one-off forensics after a messy hand-edit, where a point-in-time answer is precisely what you want.
Using both
They slot together naturally. Use migra when you need to produce structural SQL from a difference; let RowShield judge whether the running project stays private afterwards, on a schedule no one has to remember.
RowShield reads pg_catalog metadata only and is built by Veristria, an independent company unaffiliated with the migra project; references here are descriptive.
Frequently asked
- Is RowShield affiliated with the migra project?
- No. RowShield is built by Veristria, an independent company, and is neither endorsed by nor affiliated with the maintainers of migra. migra is referenced descriptively as an open-source tool.
- Is RowShield a good migra alternative?
- For generating migration SQL from a schema difference, no — migra remains a good choice and we recommend keeping it for that job. For continuous assurance that the deployed schema does not leak, yes: that verification layer simply does not exist in a manual diff workflow, and RowShield provides it.
- Does RowShield generate migration SQL?
- Not for arbitrary structural change. It generates remediation SQL for findings only — always including FORCE ROW LEVEL SECURITY — drawn from your own column names, so fixes are copy-ready without inventing schema for you.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit