{"id":43784,"library":"safegres","title":"safegres","description":"safegres is a pure-Postgres row-level security (RLS) auditor that validates grants, RLS enforcement, policy coverage, and detects risky SQL policy patterns. At version 0.10.1, it offers a CLI and library interface to audit your PostgreSQL database without requiring any application framework. Unlike other Postgres auditing tools, safegres focuses specifically on RLS misconfigurations, providing actionable reports on missing policies, overly permissive grants, and unsafe pattern usage (e.g., `current_setting` in policies). It is actively maintained with monthly releases and ships TypeScript definitions.","status":"active","version":"0.10.1","language":"javascript","source_language":"en","source_url":"https://github.com/constructive-io/constructive","tags":["javascript","postgres","rls","row-level-security","audit","security","safegres","constructive","typescript"],"install":[{"cmd":"npm install safegres","lang":"bash","label":"npm"},{"cmd":"yarn add safegres","lang":"bash","label":"yarn"},{"cmd":"pnpm add safegres","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"PostgreSQL client for database connections","package":"pg","optional":false}],"imports":[{"note":"Default export is not available; use named import.","wrong":"import safegres from 'safegres'","symbol":"audit","correct":"import { audit } from 'safegres'"},{"note":"Still works in CJS but prefer ESM since v0.9.","wrong":"const runAudit = require('safegres').runAudit","symbol":"runAudit","correct":"import { runAudit } from 'safegres'"},{"note":"AuditOptions is a TypeScript type, not a runtime value.","wrong":"import { AuditOptions } from 'safegres'","symbol":"AuditOptions","correct":"import type { AuditOptions } from 'safegres'"}],"quickstart":{"code":"import { audit } from 'safegres';\nimport pg from 'pg';\n\nconst pool = new pg.Pool({\n  connectionString: process.env.DATABASE_URL ?? ''\n});\n\nasync function main() {\n  const results = await audit(pool, {\n    schemas: ['public'],\n    verbose: true\n  });\n  console.log(JSON.stringify(results, null, 2));\n  await pool.end();\n}\n\nmain().catch(console.error);","lang":"typescript","description":"Connects to a Postgres database using environment variable and runs an RLS audit on the public schema."},"warnings":[{"fix":"Use 'verbose: false' or limit schemas to only those you need.","message":"The 'verbose' option may produce excessive output for databases with many tables.","severity":"gotcha","affected_versions":">=0.1.0"},{"fix":"Pass a pg.Pool instance; if using a Client, wrap it in a Pool (or use runAudit with a pool).","message":"In version 0.9.0, the 'audit' function signature changed: connection parameter now expects a Pool object instead of a Client.","severity":"breaking","affected_versions":">=0.9.0"},{"fix":"Replace 'import { report } from 'safegres'' with 'import { audit } from 'safegres''.","message":"The 'report' export is deprecated; use 'audit' instead.","severity":"deprecated","affected_versions":">=0.8.0"},{"fix":"Ensure your Postgres server version is >= 9.5.","message":"Does not work with PostgreSQL 9.x or earlier because RLS was introduced in 9.5.","severity":"gotcha","affected_versions":">=0.1.0"},{"fix":"Access 'warning.policyName' instead of 'warning.policy' in your code.","message":"In version 0.10.0, the output format changed: 'warnings' array elements now include 'policyName' instead of 'policy'.","severity":"breaking","affected_versions":">=0.10.0"}],"env_vars":null,"search_vec":"'0.10.1':29 'action':59 'activ':78 'applic':45 'audit':38,50,94 'auditor':13 'cli':33 'construct':97 'coverag':20 'current':72 'databas':41 'definit':86 'detect':22 'e.g':71 'enforc':18 'focus':53 'framework':46 'grant':16,66 'interfac':36 'javascript':87 'level':10,92 'librari':35 'maintain':79 'misconfigur':57 'miss':62 'month':81 'offer':31 'over':64 'pattern':26,69 'permiss':65 'polici':19,25,63,75 'postgr':7,49,88 'postgresql':40 'provid':58 'pure':6 'pure-postgr':5 'releas':82 'report':60 'requir':43 'riski':23 'rls':12,17,56,89 'row':9,91 'row-level':8 'row-level-secur':90 'safegr':1,2,52,96 'secur':11,93,95 'set':73 'ship':84 'specif':54 'sql':24 'tool':51 'typescript':85,98 'unlik':47 'unsaf':68 'usag':70 'valid':15 'version':28 'without':42","created_at":"2026-06-05T17:01:27.854783+00:00","updated_at":"2026-06-05T17:01:27.854783+00:00","problems":[{"fix":"Ensure you instantiate a pg.Pool: const pool = new pg.Pool({ connectionString: DATABASE_URL });","cause":"Passed a pg.Client instead of pg.Pool to the audit function.","error":"TypeError: pool.query is not a function"},{"fix":"Upgrade Postgres to >=9.5 or grant the necessary privileges.","cause":"PostgreSQL server version is too old (before 9.5) or the user lacks permissions to access system catalogs.","error":"relation 'pg_policies' does not exist"},{"fix":"Run 'npm install safegres' and ensure your import path is correct.","cause":"Package not installed or using a wrong import path.","error":"Cannot find module 'safegres'"},{"fix":"Create a Pool first: const pool = new pg.Pool({ connectionString: DATABASE_URL });","cause":"Passing a connection string directly instead of a Pool object.","error":"expected pool to be a Pool instance, got object"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/constructive-io/constructive","github":"https://github.com/constructive-io/constructive","docs":null,"changelog":null,"pypi":null,"npm":"safegres","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security","database"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-05","next_check":"2026-09-03","install_tag":null}}