Comparisons / Schema diff & drift
RowShield vs pg-schema-diff: DDL planning versus live verification
The short version
- pg-schema-diff is Stripe’s open-source Go library and CLI that diffs PostgreSQL schemas and generates migration plans designed to minimise locking, with warnings about hazardous statements. RowShield is a scheduled monitor that verifies the authorisation outcome of those migrations on a running Supabase project and alerts when it changes.
- Choose pg-schema-diff when — you are building deployment plumbing and want machine-readable plans that avoid table locks during busy windows.
- Choose RowShield when — you ship to Supabase and need someone watching what those plans did to policies, buckets and the anon surface — hourly if necessary — with regressions flagged as regressions.
RowShield rules relevant here
Head to head: pg-schema-diff vs RowShield
| Capability | pg-schema-diff | RowShield | Edge |
|---|---|---|---|
| Core job | Computes schema differences and produces migration plans optimised to reduce lock impact. | Computes the security posture of the live project each scan and diffs it against the previous snapshot. | RowShield |
| Hazard model | Warns about dangerous statements from a locking-and-availability perspective. | Flags hazards from an access-control perspective: disabled RLS, tautological policies, missing WITH CHECK, exposed buckets and keys. | RowShield |
| Policy awareness | The plan concerns structure; authorisation semantics are not the hazard being scored. | Policies are the subject: their existence, their conditions, and whether write paths carry WITH CHECK clauses. | RowShield |
| Live behaviour | Runs offline against schemas; no requests are issued to the deployed service. | The probe asks PostgREST what the anon key can fetch, GET only, using access a visitor already has. | RowShield |
| Time axis | A planning input used inside your pipeline when you invoke it. | Continuous snapshots from every fifteen minutes to daily, with created / resolved / regressed classification. | RowShield |
| Integration effort | A Go library you embed or a CLI you wire into your deploy tooling yourself. | Hosted scans with a URL alone for the free probe; alerting destinations configured in the dashboard. | RowShield |
| Engineering pedigree for DDL planning | Purpose-built for low-lock migration planning with documented hazard warnings — genuinely strong at that job. | Out of scope: RowShield does not plan or execute DDL. | pg-schema-diff |
Column claims about pg-schema-diff are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What pg-schema-diff does
pg-schema-diff, published by Stripe under an open-source licence, takes two PostgreSQL schemas, computes the delta, and emits a migration plan ordered to minimise locking, flagging statements that could hurt availability. The README, verified 2026-08-23, describes schema diffing with lock-minimising plans and hazard warnings for risky operations.
It is a thoughtful piece of engineering aimed at a specific failure mode: large production tables made unavailable by careless DDL. Teams embed the library in Go deploy tooling or call the CLI from scripts. Its concerns are locks, timeouts and statement danger — properties of the transition, not of the authorisation state left behind.
Where the scopes differ
pg-schema-diff evaluates how a change runs; RowShield evaluates what a change leaves behind. Both questions matter, and they barely overlap. A migration can pass every lock check, apply in milliseconds, and still drop a policy, rewrite one to USING (true), or leave a new table with row level security never enabled. None of those outcomes registers as a hazard to a locking analyser, because nothing about them threatens availability.
Supabase adds surface area vanilla Postgres tools do not model: the anon/service_role key split, the PostgREST HTTP surface, storage bucket policies. Drift there is behavioural — what the anon caller can fetch — and only observable by issuing requests. No offline planner observes it, and none claims to.
Finally, time. A planning library sees the world when invoked. Between invocations — evenings, weekends, the hour after an AI-generated migration merges — nobody is checking. RowShield’s whole premise is closing that gap with scheduled scans and transition-classified alerts.
Why Supabase teams choose RowShield over pg-schema-diff
Because lock-minimised plans say nothing about the row-level outcome. RowShield ships nine rules tuned to Supabase — RLS_DISABLED, RLS_TAUTOLOGY, MISSING_WITH_CHECK among them — plus PUBLIC_BUCKET_EXPOSURE and SERVICE_ROLE_KEY_EXPOSED, so the things a migration can silently break are checked every scan, automatically.
The probe then confirms behaviour: it calls PostgREST as the anonymous role and records ANON_TABLE_READABLE findings where data comes back. Findings diff across scans, so reverting last week’s fix surfaces as a regression, not a novelty. Remediation SQL is generated from your columns with FORCE ROW LEVEL SECURITY included, and the CLI wraps the same engine with CI-safe exit codes if you want the check beside your existing pipeline.
Where pg-schema-diff is the right choice
If your pain is DDL safety on large tables — index builds blocking writes, long ACCESS EXCLUSIVE holds — pg-schema-diff addresses a problem RowShield deliberately does not touch, and we would rather send you there than pretend otherwise.
Go-heavy teams building custom deploy pipelines will also get more from embedding a library than from any hosted monitor.
Using both
The pairing is unusually clean: pg-schema-diff makes the transition safe, RowShield keeps the resulting state honest. Plan the migration with their hazard warnings; verify the post-deploy posture with ours, on schedule.
RowShield reads pg_catalog metadata only and is built by Veristria, independent of Stripe and unaffiliated with the pg-schema-diff project; references are descriptive.
Frequently asked
- Is RowShield affiliated with Stripe or the pg-schema-diff project?
- No. RowShield is built by Veristria, an independent company, and is neither endorsed by nor affiliated with Stripe, Inc. pg-schema-diff is referenced descriptively as an open-source project.
- Is RowShield a good pg-schema-diff alternative?
- For planning low-lock DDL, no — keep pg-schema-diff for that. For verifying that deployed migrations preserved your authorisation posture on Supabase, yes: that is the layer the library leaves to you, and RowShield automates it.
- Does the RowShield probe write anything to my database?
- No. Catalog rules read pg_catalog metadata through a read-only connection, and the probe issues GET requests to your public API exactly as an anonymous visitor would. Nothing is written, and keys found in bundles are stored as fingerprints, never retained.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit