Comparisons / Postgres linters
RowShield vs pglinter: database linting vs continuous monitoring
The short version
- pglinter is a Postgres extension that lints the database from within: callable checks flag configuration anti-patterns and return the findings as result sets. RowShield is a scheduled monitor over a Supabase project — security posture, anon behaviour and drift, with pushed alerts.
- Choose pglinter when — you want an in-database hygiene sweep you can call whenever a DBA is already connected.
- Choose RowShield when — you want security posture checked on a schedule, behaviour probed as your anon caller, and every regression reported to chat or email.
RowShield rules relevant here
Head to head: pglinter vs RowShield
| Capability | pglinter | RowShield | Edge |
|---|---|---|---|
| Residence | Runs inside Postgres as an extension, close to the truth it inspects. | An external monitor reading the same catalog over a catalog-read connection. | Parity |
| Analysis lens | Configuration hygiene: settings and object-level choices that commonly cause trouble. | Security posture: policy shapes, exposure, key handling and anon reachability. | RowShield |
| Cadence | Answers when called; silence in between. | Scheduled scans from daily to every 15 minutes by plan, diffed against the last. | RowShield |
| Behaviour probe | Inspects configuration; issues no client requests. | A GET-only probe exercises PostgREST as the anon caller and records results. | RowShield |
| Supabase idiom | A generic Postgres view; no knowledge of auth.uid() idioms or storage. | Rules written for Supabase constructs specifically, including storage and bundles. | RowShield |
| Alert delivery | Result sets wherever you happened to run the query. | Slack, Discord, email and webhook notifications on transitions. | RowShield |
| Coverage breadth | A broad configuration surface beyond security concerns. | Nine security rules, deliberately narrow. | pglinter |
Column claims about pglinter are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What pglinter does
pglinter is a Postgres extension that lints the database from the inside. Its checks are callable from SQL, and they flag configuration anti-patterns — the sort of settings and object-level choices that quietly cause trouble — returning findings as ordinary result sets. It belongs to the growing family of in-database linters, alongside tools such as plpgsql_check for function bodies.
Being inside the database is a real advantage: the extension sees exactly what the server sees, with no credentials to share and no second system to reconcile. Nothing on this page argues with that design.
Where the scopes differ
The lens differs first. pglinter's published focus is configuration hygiene across a broad surface; RowShield's nine rules are security semantics on the Supabase data plane — RLS state, tautological predicates, missing WITH CHECK clauses, unindexed policy predicates, unwrapped auth.uid() calls, bucket exposure, anon-readable tables and service_role keys in deployed bundles. Breadth versus deliberate depth, honestly stated in both directions.
Mapped onto RowShield's three lenses: pglinter holds posture partially — configuration, not policy semantics or behaviour — and holds neither a behaviour probe nor a time axis. It answers when called; between calls there is no record, no diff, and no alert. RowShield scans on a schedule, snapshots the catalog, classifies every change as created, resolved or regressed, and pushes transitions to your alert channels.
The Supabase layer matters too. auth.uid() performance idioms, the anon/service_role key split, PostgREST surface and storage policies are Supabase constructs; a generic Postgres linter has no vocabulary for them, which is not a defect in it — it is simply a different remit.
Why Supabase teams choose RowShield over pglinter
An in-database linter answers when someone asks; leaks happen in the intervals. RowShield converts the interval into coverage: scheduled scans diff the catalog, the GET-only probe tests what the anon caller can actually fetch, and transition alerts reach Slack, Discord, email or webhooks without anyone running a query.
The rules are Supabase-specific by construction, remediation SQL is generated from your real columns, and the CLI wraps the same engine with CI-safe exit codes. For teams whose Postgres is a Supabase project, those constructs — not generic configuration — are where the exposure lives.
Where pglinter is the right choice
For DBA-run estates that want periodic hygiene sweeps across many Postgres instances — settings, bloat-adjacent configuration, object-level choices — an in-database linter is a sensible instrument, and pglinter's breadth beyond security is a genuine strength RowShield does not attempt. RowShield covers one platform deliberately and says so; where the remit is general Postgres hygiene, this page does not compete.
Using both
They compose naturally: pglinter for the in-database hygiene sweep a DBA runs when connected, RowShield for the continuous security watch between connections. When their findings disagree, investigate before dismissing either — configuration hygiene and security posture are adjacent lenses on the same system, and each sees something the other misses.
Frequently asked
- Is RowShield affiliated with the pglinter maintainers?
- No. RowShield is an independent product by Veristria, unaffiliated with the pglinter project and its maintainers. pglinter is referenced descriptively and remains the mark of its project.
- Can I use RowShield and pglinter together?
- Yes. pglinter covers in-database configuration hygiene when a DBA calls it; RowShield covers Supabase security posture, anon behaviour and drift continuously, with pushed alerts between anyone's visits.
- Does pglinter check row level security policies?
- Its published focus is configuration anti-patterns rather than the semantics of individual policies. Policy-shape rules — tautological predicates, missing WITH CHECK — and anon-behaviour probing are RowShield's lane, which is why the two are complementary.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit