Existing issues
Affected area
Database
Problem to solve
While building on Supabase, we noticed a few tricky Row Level Security (RLS) and database bugs that can easily slip past normal checks into production:
- Infinite RLS Policy Loops: Self-referencing subqueries inside USING clauses that cause
stack depth limit exceeded crashes when executed.
- Unindexed FK Joins in Policies: Policy subqueries that join on foreign key columns missing database indexes, leading to full table scans on every request.
- Insecure SECURITY DEFINER RPC Functions: Functions created without an explicit
SET search_path = '' scoping, leaving room for schema hijacking.
Detecting these early without spinning up full local database containers every time can save developers a lot of debugging headache.
Proposed solution
We built a lightweight, zero-dependency AST static analyzer (supabase-rls-guardian & supabase-vector-sdk) that parses migration files and catches these rules in under 5ms without needing a live database daemon running.
We'd love to propose:
- Bringing these static RLS analysis rules directly into
supabase db lint.
- Adding a
--html dashboard option so teams can publish visual security audit artifacts in their CI workflows.
- Including built-in SQL generators for Reciprocal Rank Fusion (RRF) hybrid search (
match_documents_hybrid).
Everything has 100% test coverage, and we'd be super happy to open a clean Pull Request to contribute this directly to the Supabase CLI!
Alternatives considered
Relying on manual testing or spinning up full Docker containers for every quick lint check, which is usually much slower and harder to run inside lightweight GitHub Action PR checks.
Additional context
We published an open-source reference implementation and benchmark suite here:
Happy to adapt the code to fit whatever patterns the CLI team prefers!
Existing issues
Affected area
Database
Problem to solve
While building on Supabase, we noticed a few tricky Row Level Security (RLS) and database bugs that can easily slip past normal checks into production:
stack depth limit exceededcrashes when executed.SET search_path = ''scoping, leaving room for schema hijacking.Detecting these early without spinning up full local database containers every time can save developers a lot of debugging headache.
Proposed solution
We built a lightweight, zero-dependency AST static analyzer (
supabase-rls-guardian&supabase-vector-sdk) that parses migration files and catches these rules in under 5ms without needing a live database daemon running.We'd love to propose:
supabase db lint.--htmldashboard option so teams can publish visual security audit artifacts in their CI workflows.match_documents_hybrid).Everything has 100% test coverage, and we'd be super happy to open a clean Pull Request to contribute this directly to the Supabase CLI!
Alternatives considered
Relying on manual testing or spinning up full Docker containers for every quick lint check, which is usually much slower and harder to run inside lightweight GitHub Action PR checks.
Additional context
We published an open-source reference implementation and benchmark suite here:
supabase-rls-guardianHappy to adapt the code to fit whatever patterns the CLI team prefers!