Start with what the audit can see

Constructive’s Safegres gives PostgreSQL teams a way to review access controls as part of a database release. Its public documentation describes checks for table permissions, row-level security policies and access inherited through roles. The project also assesses performance issues associated with indexes and policy expressions.

The important setup decision is which account performs the audit. Constructive warns that a role without sufficient privileges may not see every policy or grant. Teams should resolve those visibility warnings before treating a favorable result as evidence about the whole application.

Define the application boundary

The documentation asks users to identify the schemas their application exposes. That configuration affects the main security score; other findings remain available in the report. CGH’s assessment is that reviewers should examine both the configured boundary and the underlying findings, rather than approve a release from its grade alone.

Safegres can produce reports for continuous-integration systems and compare results with a previous baseline. This lets teams focus release checks on newly introduced problems while keeping older findings visible. Constructive describes the analysis as reading database metadata and parsing SQL without executing application queries or changing database objects. CGH has not tested those assurances.

Check requirements before deployment

The repository lists version 1.30.7 with a November 5 changelog entry. Earlier versions are also documented, so the November 6 public announcement should not be read as the software’s first existence. The stated minimum is PostgreSQL 14; an optional query-planner check needs version 16 or later.

The source is available under the MIT license. That does not remove hosting, database or CI costs. No country-specific service commitment or commercial support price was established in the reviewed repository. Workload-statistics checks also need meaningful runtime data; an empty test database cannot supply a representative production workload.