Skip to content

Add pgrls (static analyzer for Postgres Row-Level Security) to Security#514

Open
dmitrymaranik wants to merge 1 commit into
dhamaniasad:masterfrom
dmitrymaranik:add-pgrls
Open

Add pgrls (static analyzer for Postgres Row-Level Security) to Security#514
dmitrymaranik wants to merge 1 commit into
dhamaniasad:masterfrom
dmitrymaranik:add-pgrls

Conversation

@dmitrymaranik
Copy link
Copy Markdown

Adds pgrlshttps://github.com/pgrls/pgrls — to the Security section.

pgrls is a static analyzer for Postgres Row-Level Security. It connects to a live database, walks the parsed AST of every policy predicate (via pglast / pg_query), and reports auth bugs, predicate logic flaws, and per-row performance traps. The current release ships 36 lint rules (SEC001–SEC026 for security, PERF001–PERF003 for per-row performance, HYG001–HYG003 for hygiene, VIEW001–VIEW004 for view-mediated bypasses), 10 of which are mechanically auto-fixable via pgrls fix. A pgrls diff command compares two Postgres sources (snapshot files, live databases, or migration-as-input) and classifies every change as SAFE / BREAKING / REQUIRES_REVIEW / DANGEROUS — so CI can fail merges on real security regressions without blocking safe schema migrations.

  • License: MIT (OSI-approved)
  • Languages: Python (≥3.11) — CLI plus a pytest plugin for RLS isolation tests
  • Adoption: ~2.4k PyPI downloads / month, active development (CHANGELOG covers v0.2 → v0.5.45)
  • Distribution: PyPI, pre-commit hook (.pre-commit-hooks.yaml in the repo), GitHub Actions / SARIF output

Entry follows the list's format: * [name](link) - lowercase description., single sentence, no superlatives. Linking from the README PR description per the contributing guidelines.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant