safegres

Postgres security and performance auditor. Reads the system catalog of a live database and parses every RLS policy predicate and function body into an AST to answer who can actually reach each row and what checking that costs, scored on two independent axes. Audits grants, RLS enforcement, policy coverage, risky policies, and missing indexes; outputs summaries, Markdown, JSON, and SARIF for CI with failure thresholds and change-aware baselines. No agent, no traffic, nothing executed or written.