Comparisons / API security
RowShield vs Salt Security: traffic telemetry versus policy truth
The short version
- Salt Security analyses mirrored API traffic with machine learning to build an endpoint inventory and spot anomalous behaviour across a large estate. RowShield reads the live Postgres policies behind your Supabase surface, probes PostgREST as an anonymous caller, and alerts when any of it changes.
- Choose Salt Security when — you operate many services behind gateways, need behavioural forensics across seasons of traffic, and have a platform team able to run collection points.
- Choose RowShield when — your exposure lives in one Supabase database, you want the actual policies evaluated rather than inferred, and you want findings within minutes of connecting instead of weeks of rollout.
RowShield rules relevant here
Head to head: Salt Security vs RowShield
| Capability | Salt Security | RowShield | Edge |
|---|---|---|---|
| Primary vantage point | Machine-learning analysis of mirrored traffic, reconstructing endpoints and baselining normal behaviour. | Direct evaluation of live policies, grants, functions and storage rules, read as executable SQL. | RowShield |
| Authorisation root cause | Flags anomalous access patterns; tracing them to a policy defect is left to your team. | Names the policy and clause that permitted an unwanted result, with corrected SQL supplied. | RowShield |
| Anonymous caller testing | Behavioural models learn from observed traffic; unauthenticated database probing is not part of the method. | Scheduled PostgREST probes run unauthenticated, replicating a stranger’s first reconnaissance of your data. | RowShield |
| Deployment model | Gateway plugins or network sensors rolled out under a platform team’s ownership. | A read-only connection established in minutes; nothing installed inside your infrastructure. | RowShield |
| Change responsiveness | Baselines adapt after traffic shifts become visible, which trails the underlying change. | Migrations watched continuously; a loosened clause is reported close to merge time. | RowShield |
| Behavioural forensics across services | Retained traffic history supports investigations spanning dozens of services and months of context. | Out of scope by design; RowShield watches the database, not your service mesh. | Salt Security |
| Programme contribution | Supplies traffic-layer evidence for OWASP API Top 10 reporting. | Supplies the same programme’s database-layer evidence; the perspectives complete each other. | Parity |
Column claims about Salt Security are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What Salt Security does
Salt Security helped define the category it calls API Security Posture Management. Its platform collects API traffic through gateway plugins, network sensors or cloud integrations, applies machine learning to reconstruct a complete inventory of endpoints, and baselines ordinary behaviour so deviations such as enumeration attempts or anomalous object access stand out.
Retained history allows analysts to trace an incident backwards across months, and the resulting posture reporting satisfies governance programmes at large organisations. The trade-off is architectural: insight derives entirely from observed traffic, so whatever the platform cannot observe does not exist to it, and deployment presumes infrastructure teams comfortable operating collection points.
Where the scopes differ
The two products interrogate different strata of your stack. Salt watches requests: who called what, how often, and which responses came back. RowShield reads the rules that decided each response: the row level security policies attached to your tables, the grants issued to roles, the attributes on functions, the publicity of storage buckets.
A permissive USING clause produces no distinctive traffic signature until somebody exploits it; Salt sees the exploit, while RowShield sees the invitation. Conversely, an attacker rehearsing against your database tells Salt nothing unless it crosses a monitored gateway, because Salt does not watch databases at all.
Why Supabase teams choose RowShield over Salt Security
Supabase collapses the distance between frontend and database: PostgREST turns your tables into a public API surface governed almost wholly by Postgres policies. That surface is RowShield’s specialty. It connects with read-only credentials, evaluates every policy as written SQL, probes endpoints exactly as an anonymous caller would, and reports each finding with the offending clause quoted and a corrected statement proposed.
There are no agents to install, no baselines that need months to season, and no enterprise agreement to negotiate before the first finding appears, which makes the economics work for a four-person studio as readily as for a scale-up.
Where Salt Security is the right choice
If you operate a genuine API estate, dozens of services, multiple gateways, obligations to demonstrate continuous monitoring to auditors, and staff who live in security operations, Salt earns its place; its behavioural memory across seasons of traffic is difficult to replicate in-house.
Few Supabase-native products resemble that picture. Most are single databases with an authentication layer, where one careless migration matters more than a million benign requests, and that contest belongs to RowShield.
Using both
Running them in parallel involves no friction: RowShield generates no traffic for Salt to correlate and consumes none of its alerts. When Salt flags anomalous access, RowShield answers the natural follow-up, naming the policy responsible and confirming once the fix has landed. Teams often find the pairing shortens investigations, because the database explanation settles what the traffic pattern merely suggested.
Frequently asked
- Is RowShield affiliated with Salt Security?
- No. RowShield is built by Veristria and has no corporate relationship with Salt Security, Inc. Their name remains their trademark, and our characterisation rests on publicly available documentation reviewed on 2026-08-23.
- Can I use both together?
- Yes, and the combination is coherent. Salt retains its traffic intelligence across your wider estate while RowShield owns authorisation assurance for the database layer. Neither duplicates the other, so the decision between them is budgetary rather than technical.
- Does Salt Security scan Postgres row level security policies?
- It cannot. Policies are evaluated inside Postgres and never appear in request or response bodies, so no traffic-derived platform can audit them. Verifying them requires reading catalogue definitions directly, which is the foundation of RowShield’s method.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit