safegres

library0.10.1jsnpmunverified

safegres is a pure-Postgres row-level security (RLS) auditor that validates grants, RLS enforcement, policy coverage, and detects risky SQL policy patterns. At version 0.10.1, it offers a CLI and library interface to audit your PostgreSQL database without requiring any application framework. Unlike other Postgres auditing tools, safegres focuses specifically on RLS misconfigurations, providing actionable reports on missing policies, overly permissive grants, and unsafe pattern usage (e.g., `current_setting` in policies). It is actively maintained with monthly releases and ships TypeScript definitions.

security database

npm install safegres

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · SAFEGRES

safegres

securityjavascriptv0.10.1

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

audit

✓ import { audit } from 'safegres'

✗ import safegres from 'safegres'

Default export is not available; use named import.

runAudit

✓ import { runAudit } from 'safegres'

✗ const runAudit = require('safegres').runAudit

Still works in CJS but prefer ESM since v0.9.

AuditOptions

✓ import type { AuditOptions } from 'safegres'

✗ import { AuditOptions } from 'safegres'

AuditOptions is a TypeScript type, not a runtime value.

Connects to a Postgres database using environment variable and runs an RLS audit on the public schema.

import { audit } from 'safegres'; import pg from 'pg'; const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL ?? '' }); async function main() { const results = await audit(pool, { schemas: ['public'], verbose: true }); console.log(JSON.stringify(results, null, 2)); await pool.end(); } main().catch(console.error);

Debug

Known issues

gotchaThe 'verbose' option may produce excessive output for databases with many tables.

fix

Use 'verbose: false' or limit schemas to only those you need.

affects: >=0.1.0

breakingIn version 0.9.0, the 'audit' function signature changed: connection parameter now expects a Pool object instead of a Client.

fix

Pass a pg.Pool instance; if using a Client, wrap it in a Pool (or use runAudit with a pool).

affects: >=0.9.0

deprecatedThe 'report' export is deprecated; use 'audit' instead.

fix

Replace 'import { report } from 'safegres'' with 'import { audit } from 'safegres''.

affects: >=0.8.0

gotchaDoes not work with PostgreSQL 9.x or earlier because RLS was introduced in 9.5.

fix

Ensure your Postgres server version is >= 9.5.

affects: >=0.1.0

breakingIn version 0.10.0, the output format changed: 'warnings' array elements now include 'policyName' instead of 'policy'.

fix

Access 'warning.policyName' instead of 'warning.policy' in your code.

affects: >=0.10.0

Errors

Common errors & fixes

TypeError: pool.query is not a function

Passed a pg.Client instead of pg.Pool to the audit function.

fix

Ensure you instantiate a pg.Pool: const pool = new pg.Pool({ connectionString: DATABASE_URL });

relation 'pg_policies' does not exist

PostgreSQL server version is too old (before 9.5) or the user lacks permissions to access system catalogs.

fix

Upgrade Postgres to >=9.5 or grant the necessary privileges.

Cannot find module 'safegres'

Package not installed or using a wrong import path.

fix

Run 'npm install safegres' and ensure your import path is correct.

expected pool to be a Pool instance, got object

Passing a connection string directly instead of a Pool object.

fix

Create a Pool first: const pool = new pg.Pool({ connectionString: DATABASE_URL });

Upgrade

Version history

0.10.1latest on npm

Audit

Dependencies

pgrequiredPostgreSQL client for database connections

Agent activity

29 hits · last 30 days

node