This open-source tool evaluates which roles in the real-time Postgres database have access to which rows, helping to identify row-level security and permission errors in CI, and preventing them from being introduced into the released versions by proxy and AI application build tools.

San Francisco, November 6, 2026 / PRNewswire / -- Constructive ( constructive.io ) Today, we announce the public release of Safegres, an open-source verification tool for Postgres security. Constructive is a company that provides "default security" Postgres infrastructure for proxies. Safegres is a tool launched by Constructive that allows for read-only auditing of row-level security ( RLS ) policies and authorization in real-time PostgreSQL databases, and reports which roles can access which rows. It does not touch application data nor does it change anything, so teams can run it on production copies or automatically every time there is a database change.

On October 30, 2026, Supabase stopped automatically granting access rights to new tables. Authorization determines whether a certain role can access a table, while RLS decides which rows that role can view. Independent research shows that both of these aspects are important. On November 2, security firm Crissy Field and the German newspaper Handelsblatt scanned 159,041 projects built using Lovable, which is a AI application building tool. They found that 24,664 websites' Postgres databases were providing records to anonymous visitors, with 7,403 of them exposing email addresses. UpGuard discovered that among approximately 300,000 domain names, 16,326 databases exposed readable tables; Shippable found that in 4,994 projects built with Bolt.new, 25.6% of the tables were open to the public; CVE-2025-48757 identified 303 exposed endpoints in 170 Lovable applications. These are all configuration errors that the AI tool may repeatedly make on a large scale, and authorization checks as well as RLS inspections can detect such issues. Databricks states that nowadays, proxies are creating 80% of the databases on Neon, while Supabase claims that 70% of the new databases on it are created by proxies, therefore these checks cannot rely on individuals remembering to run them. Safegres will check authorization and RLS simultaneously after each change on any Postgres, providing a method for teams building AI and “vibe-coded” applications to verify database security before release.

Safegres is built upon the open-source “Postgres version of Babel” from Constructive – where Babel refers to the tool that enables programs to parse and rewrite JavaScript. This toolkit can convert SQL into a structured format that programs can read, check, and rewrite. The toolkit is based on the syntax of PostgreSQL itself, which is the same set of rules used by the database, and it is built upon the tools of Constructive that have been in use for nearly a decade. As a result, programs can check and rewrite SQL with the same precision as the database actually operates. The Postgres parser of Constructive is downloaded over 9 million times per month, and its parsing tools have been used in more than 1,100 public GitHub projects, including those of Canva, Gel Data (which has been acquired by Vercel), Neon, and Supabase teams.

Constructive Founder and CEO Dan Lynch stated: "The purpose of our tool is to prevent a entire class of Postgres vulnerabilities from being released, to catch errors such as missing authorization and open RLS strategies before they become CVE. The same open-source parser behind Safegres is already in use in the tools built by the Canva and Supabase teams. As security incidents in AI built applications continue to increase, these checks cannot be optional. They should become part of the development process, automated checks that run every time developers make changes to the code, and should be tested against real Postgres with each submission and migration."

Safegres Features

• Two independent evaluations: over 30 security checks and over 10 performance checks, each with its own score.
• Result certainty – no AI judges. The same database always yields the same scores, and each report has its unique “fingerprint.”
• Tested in the answer library—a sample database containing known defects, used to verify that Safegres can identify the issues that need to be found without falsely reporting issues that should not be detected.
• Designed for CI / CD – it can run within continuous integration and continuous delivery ( CI / CD ). These automated checks are executed every time a developer makes a change, including when pulling requests via GitHub, and only the issues introduced by that change are marked.
• Adapted to the commonly used technology stacks of the development teams – provides ready-made configurations for Supabase, PostgREST, Hasura, Graphile, and Constructive. The Supabase team can use it to audit their own RLS strategies and authorizations.

Constructive, co-founder and head of infrastructure, Anmol Yadav stated: "As the industry now revolves around software factories, each factory needs to implement quality control at every workstation. Dan and I have been working in this direction for many years, from replicable deployment and declarative configuration to treating the infrastructure itself as an abstract syntax tree (AST). Safegres By integrating database security into the same pipeline, whether the changes are made by humans or agents, they can be executed with each commit in CI / CD."

For those writing proxies for Postgres

The sample database can also be used as a test for the AI proxy: first provide the proxy with a defective database, and then conduct a re-audit to see if it has not introduced new issues while fixing the problems.

Lynch said, "We observed that when Safegres runs during the checks by CI and GitHub, the encoding proxy that sees the results is able to capture changes in security and performance scores and fix issues on its own. This turns the verifier into a feedback loop for building evaluation and self-improving proxies."

Availability

Safegres is open-sourced under the MIT license and can be used in conjunction with the Supabase project, any PostgreSQL database, as well as common CI pipelines.

Safegres is part of a larger open-source toolkit called Constructive. pgpm organizes the code from Postgres into packages, pgsql-test runs tests on real databases, and Safegres checks for security and performance errors in each change. Constructive indicates that these tools together cover the entire development process, as described by PostgreSQL.org.

For more information, please visit constructive.io.

About Constructive

Constructive builds an infrastructure oriented towards proxies, combining modular and open-source Postgres with a default secure database architecture, designed for the AI era. As proxies begin to generate and run applications, Constructive integrates trust, access control, and data integrity directly into the database itself. Its platform covers the entire application stack, from the database schema to API and then to front-end integration, using a compiler-driven approach to generate and enforce the system end-to-end. This unified model replaces fragmented tools with a single, composable foundation, providing support for building secure, production-ready applications. The open-source Postgres tool, developed by Constructive, has been adopted by teams at Canva, Gel Data (which was acquired by Vercel), Neon, and Supabase. It has been downloaded over 275 million times and supports the operation of nearly 50 million databases. Constructive is led by Dan Lynch, who has been building website generators since 2005 and co-founded two acquired companies: Brandcast (acquired by TIME) and Famo.us (acquired by AMZE). Investors include Marc Benioff, Reid Hoffman, and Naval Ravikant. For more information, please visit constructive.io.