The Pulse

Constructive Open-Sources Safegres to Audit Postgres Row-Level Security and Grants

Constructive’s Safegres audits Postgres row-level security policies and grants, reporting which roles can reach which rows. The tool is read-only and offers separate security and performance checks, with support for common CI pipelines.

AI.info Team · Written with AI · fact-checked · 2026-11-06

Release cites scan of Lovable projects

Constructive announced the public release of Safegres on Nov. 6 as an open-source verifier for Postgres security. Its release describes the tool as a way to audit row-level security (RLS) policies and grants in a live PostgreSQL database and report which roles can reach which rows.

The announcement cites a Nov. 2 scan by Hamburg security firm Crissy Field and German newspaper Handelsblatt of 159,041 projects built with Lovable, an AI app builder. The scan found 24,664 sites whose Postgres databases were serving records to anonymous visitors, including 7,403 exposing email addresses, according to the release. It also cites findings by UpGuard of 16,326 databases exposing readable tables across about 300,000 domains, and by Shippable that tables were open to the public in 25.6% of 4,994 Bolt.new projects. CVE-2025-48757 covered 303 exposed endpoints across 170 Lovable apps, the release says.

Separate checks for security and performance

Teams can run Safegres against a production copy or automatically on every database change. It grades security and performance separately, with more than 30 security checks and more than 10 performance checks.

The tool follows permissions through inherited roles, shared defaults, views and functions to show what each role can actually reach. A library of sample databases with known flaws is used to check that Safegres finds the intended problems without flagging issues it should not.

Built on Constructive's Postgres tooling

Safegres is built on Constructive's open-source “Babel for Postgres” toolkit, which translates SQL into a structured form that programs can read, check and rewrite. The toolkit uses PostgreSQL's own grammar, the same rules the database uses. Constructive’s Postgres parser is downloaded more than 9 million times a month and its parser tools have been used in more than 1,100 public GitHub projects, including projects from teams at Canva, Gel Data, Neon and Supabase, the company says. The release identifies Gel Data as acquired by Vercel.

Use in CI and with AI agents

Safegres runs in continuous integration and delivery (CI/CD), including on GitHub pull requests, and flags only issues introduced by a change. Safegres works with Supabase, PostgREST, Hasura, Graphile and Constructive, and Supabase teams can use it to audit RLS policies and grants.

The sample databases can also be used to test AI agents: an agent can be given a flawed database, then the database can be audited again to check whether the agent fixed the problem without creating new ones. “We noticed that when Safegres runs in CI and GitHub checks, coding agents that can see the results pick up changes in the security and performance scores and fix the issues on their own,” said Dan Lynch, Founder and CEO of Constructive. He added: “That turns the verifier into a feedback loop for building evals and self-improving agents.”

Safegres is open source under the MIT license and works with any PostgreSQL database and common CI pipelines. Safegres is part of a broader open-source toolkit that also includes pgpm, for organizing Postgres code into packages, and pgsql-test, for running tests against a real database.