pgrls in the wild
Row-Level Security bugs are easy to write and hard to see — an unwrapped per-row auth.uid(), a missing WITH CHECK, an anonymously-readable table, a cross-tenant leak. pgrls surfaces them and pgrls fix writes the migration.
Below are real fixes it produced for open-source Postgres / Supabase projects.
Merged upstream
Accepted by the maintainers.
| Project | ★ | What pgrls surfaced | Links |
|---|---|---|---|
| windmill-labs/windmill | 17,533★ | Wrap current_setting('session.*') reads across every RLS policy | issue · #10110 |
| MODSetter/SurfSense | 15,906★ | Scope index endpoint authorization | #1503 |
| miurla/morphic | 9,037★ | Wrap current_setting() for per-statement eval | #902 |
| ruvnet/RuVector | 4,418★ | Wrap current_setting() in the tenancy RLS codegen (Rust) | #639 |
| JasperFx/marten | 3,440★ | Wrap current_setting() in the generated tenant policy (.NET) | #4805 |
| gridaco/grida | 2,607★ | Wrap auth.uid() (FORCE RLS flagged as optional) | issue · #874 |
| MicroPyramid/Django-CRM | 2,382★ | Wrap current_setting() in the org-isolation policy codegen | #711 |
| crbnos/carbon | 2,358★ | Per-statement auth wrap (USING + WITH CHECK) | issue · #965 |
| saltcorn/saltcorn | 2,053★ | Wrap current_setting() in the generated RLS policy codegen (Node/TS) | #4286 |
| moyangzhan/langchain4j-aideepin | 1,351★ | Fix cross-user knowledge-base read | issue · #105 |
| elymsyr/dungeon-master-tool | 111★ | Wrap auth calls across 56 policies | #74 |
| usetrmnl/byos_next | 93★ | Wrap the per-row session lookup | issue · #82 |
| kdpisda/django-rls | 92★ | RLS-hardening polish items | issue · #54 |
| OpenStudy-dev/OpenStudy | 69★ | Wrap RLS policy functions | issue · #3 |
| tutur3u/platform | 53★ | Wrap auth calls (incl. correlated EXISTS) | #4907 |
In review
Open pull requests.
| Project | ★ | What pgrls surfaced | Links |
|---|---|---|---|
| onlook-dev/onlook | 26,482★ | Wrap auth calls in RLS policies | #3121 |
| midday-ai/midday | 14,740★ | Wrap the last two bare auth.uid() policies (Drizzle schema codegen) | #893 |
| Helicone/helicone | 6,064★ | Wrap auth calls for per-statement eval | #5705 |
| archtechx/tenancy | 4,391★ | Wrap current_setting() in the RLS PolicyManager codegen (Laravel) | #1468 |
| butterbase-ai/butterbase | 3,047★ | Wrap current_setting('app.role') in the service-role policies | #88 |
| scosman/CMSaasStarter | 2,355★ | Wrap auth.uid() | issue · #213 |
| lucasastorian/llmwiki | 1,493★ | Wrap auth.uid() | issue · #64 |
| firecrawl/open-scouts | 1,357★ | Wrap auth.uid() | issue · #13 |
| usebasejump/basejump | 940★ | Wrap auth.uid() in the account policies (Supabase teams template) | #106 |
| KolbySisk/next-supabase-stripe-starter | 808★ | Wrap auth.uid() | #31 |
| Kanba-co/kanba | 641★ | Wrap auth calls (USING + WITH CHECK) | #32 |
| supabase-community/chatgpt-your-files | 514★ | Wrap auth.uid() | #53 |
| 10xapp/core-oss | 434★ | Wrap auth.uid() for per-statement eval | issue · #51 |
| DannyMac180/meta-agent | 419★ | Wrap current_setting() in RLS policies | #222 |
| antoineross/Hikari | 390★ | Harden RLS: wrap + index filters | issue · #7 |
| supabase-community/svelte-kanban | 314★ | Harden RLS: wrap, index, FORCE | issue · #26 |
| nolly-studio/ai-chatbot-supabase | 290★ | Wrap auth calls (24 policies) | #4 |
| AlexanderCollins/TurboDRF | 158★ | Wrap current_setting() in the RLS predicate codegen (Django) | #49 |
| kizivat/saas-kit | 126★ | Wrap auth.uid() | #7 |
| GeronimoDiClemente/raven-nest | 32★ | Wrap auth calls (39 policies) | #12 |
| getpact/pact | 21★ | Wrap current_setting() | issue · #7 |
| isaacsight/kernel | 16★ | Wrap 131 policy auth calls | #54 |
| arcadia-eternity/arcadia-eternity | 10★ | Wrap RLS policy functions | issue · #196 |
Ecosystem
| Project | ★ | What pgrls surfaced | Links |
|---|---|---|---|
| drizzle-team/drizzle-orm | 35,467★ | Add .forceRLS() to the pgTable builder | issue · #5843 |
| analysis-tools-dev/static-analysis | 14,730★ | List pgrls | #1829 |
| dhamaniasad/awesome-postgres | 12,044★ | List pgrls | #514 |
| supabase/splinter | 266★ | Propose a lint for inverted-auth read policies | issue · #169 |
Have an RLS issue pgrls could help with? pip install pgrls && pgrls lint, or open an issue.