Commits

Branch selector

 main

User selector

All users

All time

Commit History

Commits on Jun 10, 2026

• feat(verify): --format sarif — SARIF v2.1.0 for GitHub Code Scanning (#202)

  Show description for bd33b5a
  dmitrymaranik

  authored
  bd33b5a

  Copy full SHA for bd33b5a

• test(demo): SEC039 live e2e case — fires on anon-write, silent on anon-read (#201)

  Show description for 9d34668
  dmitrymaranik

  authored
  9d34668

  Copy full SHA for 9d34668

• feat(rules): SEC039 — anonymous-role write policy (52nd rule) (#200)

  Show description for a62c286
  dmitrymaranik

  authored
  a62c286

  Copy full SHA for a62c286

• feat(verify): cross-tenant recall for integer/bigint tenant keys (#199)

  Show description for 673846c
  dmitrymaranik

  authored
  673846c

  Copy full SHA for 673846c

Commits on Jun 9, 2026

• fix(verify): cross-tenant unconditional leak reads "any other tenant" (#198)

  Show description for 47fdd7b
  dmitrymaranik

  authored
  47fdd7b

  Copy full SHA for 47fdd7b

• fix(verify): emit-repro treats the PUBLIC pseudo-role case-insensitively (#197)

  Show description for 29ce01a
  dmitrymaranik

  authored
  29ce01a

  Copy full SHA for 29ce01a

• feat(verify): pgrls verify --mode cross-tenant --emit-repro — runnable cross-tenant leak reproductions (#196)

  Show description for 4958a26
  dmitrymaranik

  authored
  4958a26

  Copy full SHA for 4958a26

• feat(verify): pgrls verify --mode cross-tenant — prove authenticated cross-tenant isolation (#195)

  Show description for 8ff9459
  dmitrymaranik

  authored
  8ff9459

  Copy full SHA for 8ff9459

• fix(pyproject): shorten description to ≤512 chars (PyPI summary limit) (#194)

  Show description for 4904bdc
  dmitrymaranik

  authored
  4904bdc

  Copy full SHA for 4904bdc

• test(verify): pin the emit-repro cross-table header caveat (#193)

  Show description for 2fe5b17
  dmitrymaranik

  authored
  2fe5b17

  Copy full SHA for 2fe5b17

• feat(verify): --emit-repro — turn a leak counterexample into a runnable reproduction (#192)

  Show description for a774d81
  dmitrymaranik

  authored
  a774d81

  Copy full SHA for a774d81

Commits on Jun 8, 2026

• feat(verify): pgrls verify — Z3 tenant-isolation proof with counterexample (#191)

  Show description for bf1227e
  dmitrymaranik

  authored
  bf1227e

  Copy full SHA for bf1227e

• docs(supabase): document `pgrls lint --supabase` (no live database) in the CI recipe (#190)

  Show description for 70f9e71
  dmitrymaranik

  authored
  70f9e71

  Copy full SHA for 70f9e71

• fix(diff): provision non-PUBLIC baseline roles via psycopg.sql, not a server-side param (#189)

  Show description for 8aca0a6
  dmitrymaranik

  authored
  8aca0a6

  Copy full SHA for 8aca0a6

• feat(matrix): pgrls matrix — effective role × table × command access matrix (#188)

  Show description for cdd325c
  dmitrymaranik

  authored
  cdd325c

  Copy full SHA for cdd325c

• feat(lint): --migrations — lint with no live database (#187)

  Show description for 1c692d4
  dmitrymaranik

  authored
  1c692d4

  Copy full SHA for 1c692d4

Commits on Jun 3, 2026

• release: 0.17.0 — column-level grants + 20-round soundness/precision hardening (#186)

  Show description for a2d090b
  dmitrymaranik

  authored
  a2d090b

  Copy full SHA for a2d090b

• Merge pull request #185 from pgrls/fix/secdef-leakproof-dotted-schema-split

  Show description for b4500ee
  dmitrymaranik

  authored
  b4500ee

  Copy full SHA for b4500ee

• fix(corpus): re-adjudicate stale SEC006 positive; add the genuine INSERT-no-WITH-CHECK hole

  Show description for 9945f9a
  dmitrymaranik

  committed
  9945f9a

  Copy full SHA for 9945f9a

• test(z3): pin the incomparable counterexample admit-path + pragma the unreachable witness-gate bail

  Show description for cf8ec8c
  dmitrymaranik

  committed
  cf8ec8c

  Copy full SHA for cf8ec8c

• fix(SEC036): recognize a single-target IN/ANY sub-query as a caller binding

  Show description for 9462241
  dmitrymaranik

  committed
  9462241

  Copy full SHA for 9462241

• test(perf004,apply-cache): pin the nested-BoolExpr walk and commit_baseline failure paths

  Show description for 694643a
  dmitrymaranik

  committed
  694643a

  Copy full SHA for 694643a

• fix(introspect): SELECT DISTINCT in the grant queries so multi-grantor ACLs don't duplicate privileges

  Show description for fb7f008
  dmitrymaranik

  committed
  fb7f008

  Copy full SHA for fb7f008

• fix(z3/SEC038): abstain on a mismatched-sort COALESCE fold instead of fabricating an anon-read leak

  Show description for 94a58a4
  dmitrymaranik

  committed
  94a58a4

  Copy full SHA for 94a58a4

• test(coverage): pin the empty-report (no-policies) renderer branches

  Show description for f43485e
  dmitrymaranik

  committed
  f43485e

  Copy full SHA for f43485e

• fix(SEC026): treat SIMILAR TO like LIKE/regex in the admin-escape literal-pattern guard

  Show description for 512149c
  dmitrymaranik

  committed
  512149c

  Copy full SHA for 512149c

• test(model,diff): cover column-grant to_sql emission + GRANT_REVOKED diff branch

  Show description for 7bacf68
  dmitrymaranik

  committed
  7bacf68

  Copy full SHA for 7bacf68

• fix(generate): reject a multi-dot --auth-function instead of mis-quoting it

  Show description for bd67212
  dmitrymaranik

  committed
  bd67212

  Copy full SHA for bd67212

• fix(SEC026): don't flag an auth value matched against a hard-coded literal pattern

  Show description for be59013
  dmitrymaranik

  committed
  be59013

  Copy full SHA for be59013

• fix(SEC033): require the JSON chain to root in a JWT source before flagging user_metadata

  Show description for f0efb73
  dmitrymaranik

  committed
  f0efb73

  Copy full SHA for f0efb73

• fix(perf004): arity-gate `length` so the fixer abstains on the STABLE 2-arg overload

  Show description for ee0ca9f
  dmitrymaranik

  committed
  ee0ca9f

  Copy full SHA for ee0ca9f

• fix(config): defer [database].url env interpolation so no-DB commands don't false-fail

  Show description for 9cab253
  dmitrymaranik

  committed
  9cab253

  Copy full SHA for 9cab253

• feat(diff): capture column-level grants so PUBLIC column grants on no-RLS tables are flagged

  Show description for 660d2b6
  dmitrymaranik

  committed
  660d2b6

  Copy full SHA for 660d2b6

• fix(SEC030): gate the nullable-discriminator check on identity-column names

  Show description for 238e8d0
  dmitrymaranik

  committed
  238e8d0

  Copy full SHA for 238e8d0

• fix(SEC026): unwrap FROM-less sub-select in the ltree/geometric non-text guard

  Show description for 3c6fae7
  dmitrymaranik

  committed
  3c6fae7

  Copy full SHA for 3c6fae7