[Feature Request] AST-based Static RLS Linter & Hybrid Search Plugin Engine for supabase db lint

Existing issues

• I have searched the existing issues.

Affected area

Database

Problem to solve

While building on Supabase, we noticed a few tricky Row Level Security (RLS) and database bugs that can easily slip past normal checks into production:

1. Infinite RLS Policy Loops: Self-referencing subqueries inside USING clauses that cause stack depth limit exceeded crashes when executed.
2. Unindexed FK Joins in Policies: Policy subqueries that join on foreign key columns missing database indexes, leading to full table scans on every request.
3. Insecure SECURITY DEFINER RPC Functions: Functions created without an explicit SET search_path = '' scoping, leaving room for schema hijacking.

Detecting these early without spinning up full local database containers every time can save developers a lot of debugging headache.

Proposed solution

We built a lightweight, zero-dependency AST static analyzer (supabase-rls-guardian & supabase-vector-sdk) that parses migration files and catches these rules in under 5ms without needing a live database daemon running.

We'd love to propose:

1. Bringing these static RLS analysis rules directly into supabase db lint.
2. Adding a --html dashboard option so teams can publish visual security audit artifacts in their CI workflows.
3. Including built-in SQL generators for Reciprocal Rank Fusion (RRF) hybrid search (match_documents_hybrid).

Everything has 100% test coverage, and we'd be super happy to open a clean Pull Request to contribute this directly to the Supabase CLI!

Alternatives considered

Relying on manual testing or spinning up full Docker containers for every quick lint check, which is usually much slower and harder to run inside lightweight GitHub Action PR checks.

Additional context

We published an open-source reference implementation and benchmark suite here:

• GitHub: https://github.com/supabase-community/rls-guardian
• npm: supabase-rls-guardian

Happy to adapt the code to fit whatever patterns the CLI team prefers!