RowShield vs Spacelift: row-level posture versus pipeline governance

Head to head: Spacelift vs RowShield

Column claims about Spacelift are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.

What Spacelift does

Spacelift wraps Terraform, Pulumi and CloudFormation in managed delivery workflows. Stacks map to directories of code, runs produce plans, and Open Policy Agent rules decide what may proceed. Drift detection schedules refreshes so manual console changes to declared resources surface and can be reconciled.

Its strengths are real. Policy-as-code gives platform teams one lever over what reaches production, and the drift loop narrows the classic gap between console edits and pipeline discipline — at least for the resources Terraform owns.

Where the scopes differ

Everything Spacelift observes has a Terraform address: a bucket, a cluster, a database instance. Row-level security has no such address unless a team goes out of its way to manage policies as code. In most Supabase projects they do not: policies accumulate through migrations, SQL editor sessions and dashboard toggles, and the authoritative copy lives in the catalog alone.

So when Spacelift reports no drift, it makes a precise claim about state files and cloud resources. It is silent about whether the anon role gained a broad grant last Tuesday, or whether a debug policy allowing all rows survived its incident. Those questions need an instrument pointed at the catalog — and behaviour checks besides, since a policy can deparse correctly and still behave wrongly for a real anon request.

Why Supabase teams choose RowShield over Spacelift

RowShield points its instruments past the resource boundary. Scans enumerate every API-facing table, confirm row-level security is enabled, parse each policy for breadth, and check the grants and defaults deciding what anonymous and authenticated roles may fetch — RLS_DISABLED, RLS_NO_POLICIES and friends, each finding tied to a rule and a fix.

The cadence differs too. Spacelift drift checks run against declared resources on a schedule; RowShield treats the entire posture as continuously observable, so the interval between deploys stops being a safe harbour for quiet regressions. Findings arrive as plain explanations with remediation SQL, not as reconciliation jobs against a state bucket.

Where Spacelift is the right choice

Platform teams coordinating many stacks across clouds get substantial value: managed runners remove agent babysitting, OPA policies encode organisational rules once, and the audit trail satisfies process reviewers. If your compliance story concerns who approved what change to which stack, Spacelift speaks that language fluently.

It is also the better instrument when the feared risk is an unguarded terraform apply rather than a policy widened in a browser tab. Different fear, different tool — and even devoted Spacelift shops add a catalog watcher, because the database interior never enters their stacks.

Using both

The pair composes cleanly: Spacelift delivers the declared world, RowShield attests to the lived-in one. Teams often route RowShield alerts into the same channels their pipeline notifications occupy, giving posture regressions the audience merge failures already enjoy.

One habit worth adopting: whenever Spacelift flags drift on a Supabase stack, check RowShield for findings raised in the same window, since console changes rarely travel alone.

Frequently asked

Is RowShield affiliated with Spacelift?

No. Veristria develops RowShield independently and has no partnership or reseller arrangement with Spacelift. Descriptions here come from its public documentation.

Can Spacelift manage Supabase policies as code?

Partly, through the Postgres provider, though teams must author and maintain that mapping themselves. RowShield complements either approach by verifying the live result rather than trusting the declaration.

Which should we adopt first?

If deploys feel chaotic, start with pipeline discipline. If deploys are calm but posture is unknown, start with monitoring. Most Supabase teams discover the second problem first.