[Feature Request] AST-based Static RLS Linter & Hybrid Search Plugin Engine for supabase db lint

Open
#5,992 3 comments 0 reactions 1 assignee View on GitHub

@7ttp is already working on this.

Since Aug 3, 2026.

Assessment

This issue has not been assessed yet.

Description

✨ Feature
Existing issues
  • I have searched the existing issues.
Affected area

Database

Problem to solve

While building on Supabase, we noticed a few tricky Row Level Security (RLS) and database bugs that can easily slip past normal checks into production:

  1. Infinite RLS Policy Loops: Self-referencing subqueries inside USING clauses that cause stack depth limit exceeded crashes when executed.
  2. Unindexed FK Joins in Policies: Policy subqueries that join on foreign key columns missing database indexes, leading to full table scans on every request.
  3. Insecure SECURITY DEFINER RPC Functions: Functions created without an explicit SET search_path = '' scoping, leaving room for schema hijacking.

Detecting these early without spinning up full local database containers every time can save developers a lot of debugging headache.

Proposed solution

We built a lightweight, zero-dependency AST static analyzer (supabase-rls-guardian & supabase-vector-sdk) that parses migration files and catches these rules in under 5ms without needing a live database daemon running.

We'd love to propose:

  1. Bringing these static RLS analysis rules directly into supabase db lint.
  2. Adding a --html dashboard option so teams can publish visual security audit artifacts in their CI workflows.
  3. Including built-in SQL generators for Reciprocal Rank Fusion (RRF) hybrid search (match_documents_hybrid).

Everything has 100% test coverage, and we'd be super happy to open a clean Pull Request to contribute this directly to the Supabase CLI!

Alternatives considered

Relying on manual testing or spinning up full Docker containers for every quick lint check, which is usually much slower and harder to run inside lightweight GitHub Action PR checks.

Additional context

We published an open-source reference implementation and benchmark suite here:

Happy to adapt the code to fit whatever patterns the CLI team prefers!

Dominant language
TypeScript
Stars
2.4k
Forks
523
Avg merge
20h 47m
Merged PRs (30d)
243

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/cli

All issues in supabase/cli

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.