Open-source tool rlsautotest auto-generates pgTAP tests for Supabase RLS policies

·1 views

Row-Level Security (RLS) misconfigurations in PostgreSQL databases do not throw errors — they silently return wrong data, making leaks hard to detect before reaching production. A new open-source tool called rlsautotest addresses this by automatically generating pgTAP test suites and seed data directly from existing RLS policies. The tool works with any PostgreSQL deployment, including Supabase, Neon, and Amazon RDS, and can output an HTML permissions report or emit tests for CI pipelines. It creates realistic seed data tied to specific identities to avoid false positives from empty-table test passes. Released under the Apache-2.0 license, the project is available on GitHub at github.com/unitautogen/rlsautotest.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Finished Apps Still Fail Store Review: Policy, Not Code, Is the Blocker

A developer building a convenience-store deals app discovered that app store rejections rarely stem from buggy code but from missing compliance requirements tied to specific features. Adding user logins triggers privacy policy and data-disposal obligations, while location access and push notifications each require separate user consent flows. Even marketing copy using absolute claims like 'lowest price guaranteed' is a common rejection trigger, as is linking to placeholder URLs instead of real, live policy pages. The developer argues that every feature decision quietly carries a bundle of policy requirements that must be identified during the planning phase, not patched in after coding is complete. The core takeaway is to ask 'what compliance check does this feature summon?' before building, to avoid repeated launch delays.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Can Build Your App Fast, But Data, Compliance and Scope Will Slow Your Launch

A developer shared lessons learned after using AI to rapidly build several mini-apps and take them through to launch. While AI tools genuinely produced a working, polished app interface within a single evening, the real challenges emerged only afterward. For a convenience-store deals app, no public API existed, forcing the developer to manually collect, clean, and upload deal data every week — a recurring burden that had not been anticipated before building. Adding user-facing features like saved favorites and rewards introduced login requirements, privacy policies, and app-store compliance reviews that delayed launch by weeks beyond the coding effort. The developer concluded that a simple, accurate, maintainable product ships faster and retains users more reliably than a feature-rich app built without accounting for ongoing data upkeep and regulatory overhead.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How KYB Teams Use Czech ARES Registry Data for Company Verification

ARES, operated by the Czech Ministry of Finance, aggregates data from multiple public registers — including the Commercial Register, Trade Register, and VAT references — in a single API response, offering more cross-register detail than many compliance teams typically leverage. Know Your Business (KYB) teams using the OpenRegistry platform can retrieve key fields such as company identifier, legal name, registered address, incorporation date, and operating status for Czech entities. A key operational practice involves storing both normalised fields and the raw jurisdiction_data payload, which preserves the original registry response for audit and regulatory review purposes. However, ARES has notable limitations: it is not a beneficial ownership register, does not include sanctions screening or PEP checks, and does not maintain historical snapshots of past registry states. Some legal documents and court records also remain within separate Czech judicial systems and may require direct court-register retrieval outside of ARES.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Most AI Prompts Fail in Production and How to Fix Them

Most LLM-powered features underperform not because of the model but because prompts lack specificity, constraints, and defined failure modes. Effective production prompts specify audience, output format, detail level, and fallback instructions for uncertain cases. Structured outputs with explicit guidelines — such as JSON responses for content moderation — improve consistency and reliability over open-ended queries. Common pitfalls include overloading the model with unstructured context, ignoring edge cases, and testing only on idealized demo data rather than real-world inputs. Developers are advised to version, test, and monitor prompts as rigorously as application code.

0 comments Read more at DEV Community