matte97p/rlsgrid
Schema-driven RLS audit and cross-tenant fuzz for Postgres/Supabase. Runs in CI, fails on cross-tenant leaks.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | rlsgrid subcommand to run. One of: introspect, plan, gen-pgtap, seed, fuzz. Use `fuzz` to gate a PR on cross-tenant safety. | no | plan |
| config | Path to rlsgrid.toml. | no | rlsgrid.toml |
| database-url | Postgres connection string. Stored in $DATABASE_URL for the run. Never point this at production — rlsgrid refuses URLs matching [safety].forbid_url_patterns in your config. | yes | — |
| tenants | Number of synthetic tenants to seed (seed and fuzz only). | no | 3 |
| python-version | Python version used to install rlsgrid. | no | 3.12 |
| version | rlsgrid version to install. Defaults to the latest published release. Pin in production (e.g. "0.2.0"). | no | "" |
| pgtap-out | Output path for `gen pgtap`. Ignored for other commands. | no | tests/rls/generated.sql |
| fail-on-breach | When `command` is `fuzz`, exit the step with a non-zero status if any breach is detected. Set to "false" to keep going and inspect the JSON in a follow-up step. | no | true |
Outputs
| name | description |
|---|---|
| result-json | Path to the rlsgrid JSON output captured during the run. |
| breach-count | Number of breaches found (only meaningful for the `fuzz` command). |