Observed arrival · 2026-10-25
Tracegrid maps Supabase exposure back to code
An offline static-analysis tool that connects a Supabase schema to code call sites and reports potentially exposed database objects that no code appears to use.
- For
- Supabase developers reviewing database exposure
- Worth noticing
- Its pull-request check compares against a baseline and fails only on new Fix findings, with plugins disabled for fork-PR CI.
Field notes
Tracegrid can replay Supabase migrations or read the live catalog in read-only mode, then parse TypeScript calls to `.from`, `.rpc`, `functions.invoke`, and storage. It emits Markdown, JSON, and HTML reports; the pull-request mode is shown with plugins disabled and a baseline comparison that fails only on newly introduced Fix findings. The project reports 111 of 113 findings held up in manual checks across 20 public apps, while cautioning that findings need review.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue