BareSQL Audit on BareSQL.com

A Quarterly Access Review Finds a New Table of Bank Accounts That Every Role Can Read

Mon, 26 Oct 2026 00:00:00 +0000

The shop in this case study is made up: it’s the sample shop database that BareSQL’s tests build, and the outputs are what BareSQL printed. It reviews database access once a quarter. The first review with BareSQL Audit covers every login and ends with a file kept for next time, audit.json.

Three months later the review runs again against that file. The reviewer then reads what changed, with no need to compare two long reports by eye.

A Support View Showed Card Numbers to Every Support Login

Mon, 26 Oct 2026 00:00:00 +0000

This case study runs on the sample shop database that BareSQL’s tests build, so the shop is made up, and the outputs are what BareSQL printed. Its support team looks customers up through one view, support.customer_lookup, and has no grant on the customers table itself, which sounds like the careful way to do it.

The view was meant to show a name, an email address and a phone number, enough to help someone who calls in. At some point a column was added to it. The team has two logins, shop_alice and shop_bob. Bob is in the team without inheriting its rights, a setup often taken to mean he can’t read what the team reads.

BareSQL Launches With an Access Audit for PostgreSQL and a Portability Check for SQL

Mon, 26 Oct 2026 00:00:00 +0000

BareSQL is a free, open-source command-line program with two tools in it. BareSQL Audit lists every column each PostgreSQL login can read, with the route that gets it there, and marks the ones that hold personal data. BareSQL Portable finds the SQL that fails or answers differently on SQLite, PostgreSQL, MySQL and MariaDB. Version 0.1.0 is the first release.

Who can read the customers’ email addresses? In a PostgreSQL database the answer is spread over role memberships, grants made years ago, views that read tables with their owner’s rights, default privileges and row security policies. Working it out by hand means an afternoon with the system catalogs, and the answer is out of date the next time someone runs a GRANT. BareSQL Audit logs in, reads the catalogs inside a read-only transaction and writes the answer down: a report for people and a JSON file for the next audit to be compared with.

How BareSQL Audit Finds Every Column a PostgreSQL Login Can Read

Mon, 26 Oct 2026 00:00:00 +0000

PostgreSQL keeps the answer to “who can read this column?” in many places. Grants sit in access lists on tables and on single columns. Role memberships nest, and since PostgreSQL 16 each one says separately whether its rights are inherited and whether SET ROLE is allowed. Views read their tables with their owner’s rights unless they say otherwise, row security policies filter what a table hands out, and default privileges hand out tables that don’t exist yet.

How BareSQL Audit Was Tested Against Planted Leaks on Six PostgreSQL Versions

Mon, 26 Oct 2026 00:00:00 +0000

An access audit can be wrong in two directions. If it misses a route, a leak goes unnoticed because the report said all was well. If it invents one, people spend a day chasing access that was never there and stop trusting the report. So BareSQL Audit is tested against databases where every right answer is known in advance, and against the one judge that can’t be argued with, the PostgreSQL server itself.

What an AI Support Agent Could Read Before Its Database Login Went Live

Mon, 26 Oct 2026 00:00:00 +0000

This case study runs on the sample multi-tenant database that BareSQL’s tests build. The software company in it is made up: it runs one PostgreSQL database for all its customers, the tenants, and row security keeps each tenant’s rows apart. Every output below is what BareSQL printed.

The support team wants an AI agent to answer tickets, so the agent gets a login of its own, saas_agent, in the saas_support group that support’s views are granted to. The views were written for people, months ago, and nobody remembers exactly what they return. So before the login goes live, the team audits that one login.