Comparisons / Postgres performance
RowShield vs PgHero: runtime dashboards versus authorisation structure
The short version
- PgHero is a pleasant open-source dashboard for Postgres vital signs: slow queries, unused indexes, connection pressure. It observes behaviour. RowShield evaluates structure — the policies and grants where exposure hides — and watches it on a schedule.
- Choose PgHero when — you want a lightweight, self-hosted, inspectable health dashboard you can extend, and posture is a solved or deferred problem.
- Choose RowShield when — you need recurring proof that row-level security and grants still match intent, presented for teams who do not live in psql.
RowShield rules relevant here
Head to head: PgHero vs RowShield
| Capability | PgHero | RowShield | Edge |
|---|---|---|---|
| What is watched | Runtime signals: slowest queries, index usage, bloat, connection counts. | Authorisation structure: policies, grants, roles, defaults, and drift between scans. | Parity |
| Deployment model | Self-hosted Rails application you deploy and maintain — some teams prefer exactly that. | A managed service; nothing to host, patch or rotate beyond credentials. | PgHero |
| Exposure analysis | Absent; a healthy-looking dashboard can sit above an unprotected table. | Purpose-built, spanning RLS_DISABLED through policy breadth to ANON_TABLE_READABLE. | RowShield |
| Query performance view | Genuine strength for its size: top queries and basic index advice at a glance. | Limited to security-relevant patterns such as unindexed policy predicates. | PgHero |
| Historical posture record | Metrics windows exist; authorisation state is not among the series collected. | Scan history enables before-and-after reasoning during reviews and postmortems. | RowShield |
| Openness | Open source throughout, inspectable down to every query it runs. | Hosted product with documented methodology and readable reports. | PgHero |
| Where the domains meet | Shows the slow query without attributing the policy cause. | Explains when protection is itself the latency source, naming the pattern precisely. | RowShield |
Column claims about PgHero are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What PgHero does
PgHero is an open-source dashboard for Postgres health. Point it at a database and it renders the everyday questions: which queries are slowest, which indexes go unused, how connections trend, whether replication lags. It is light, readable and honest about being a window rather than a platform.
Many teams install it early and keep it for years, because sometimes a glanceable panel is the entire requirement — and open source means you can bend it to taste.
Where the scopes differ
Vital signs describe the present moment: load, latency, bloat. Posture describes standing permission: which roles may select from which tables under which predicates. The second is where breaches live, and it changes on human timescales — dashboard toggles, hasty migrations — rather than traffic timescales.
A Supabase project can look immaculate in PgHero while its anon role reads a table it should never see, because nothing in query statistics encodes permission. Conversely a posture-perfect database can still crawl. The instruments barely intersect, except where policy structure drives runtime cost — the seam RowShield annotates explicitly — and where live behaviour proves what configuration alone cannot.
Why Supabase teams choose RowShield over PgHero
RowShield was built around Supabase habits: rapid prototyping, dashboard edits, policies accumulated under deadline pressure. Scans test enablement, parse every policy for width, check grants and default privileges, and flag performance-coupled smells such as UNINDEXED_RLS_PREDICATE and bare per-row auth.uid() comparisons.
Output is written for mixed teams: each finding states the exposure plainly, the rule violated, and the smallest SQL repairing it, with history proving when it appeared and when it closed. That narrative is what a founder, reviewer or auditor actually needs.
Where PgHero is the right choice
Wanting a self-hosted pane of glass with zero licence conversation is legitimate, and PgHero delivers respectable value there: routine health questions answered without a platform team, full inspectability, simplicity that rarely breaks interestingly.
Choose it when the questions concern speed and capacity. Posture questions need a different instrument, whichever vendor supplies it — and even PgHero households usually add one once user data arrives.
Using both
They coexist comfortably: PgHero answers how the database feels, RowShield answers whether it behaves. Some teams mount both in one internal dashboard under dividers labelled health and safety, which is more accurate than it sounds.
When PgHero highlights a stubbornly slow query, RowShield quickly reveals whether a policy predicate is the culprit — and the fix usually improves both panels at once. That handoff - performance tooling localising the pain, security tooling explaining the policy mechanics behind it and generating the corrective SQL - is why the pairing persists even on teams that started with only one of them.
Frequently asked
- Is RowShield affiliated with PgHero?
- No. RowShield comes from Veristria and has no relationship with the PgHero maintainer or contributors. The description above reflects the public repository.
- Does PgHero show whether row-level security is enabled?
- It focuses on performance signals rather than authorisation metadata. Table-level posture, policy breadth and grant analysis fall outside what it collects.
- We are a small team. Which single tool first?
- If user data sits behind an API, posture first: exposure damages trust faster than slowness does. Add a health dashboard once safety has a standing answer.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit