Pgspot – Find vulnerabilities in Postgres SQL scripts
Hi HN! My name is Sven, I am an engineer at Timescale and this is my fun side project. The main purpose of pgspot is to check postgres extension sql scripts for vulnerabilities but it can also be used to check functions outside of extension context e.g. security definer functions. I've started working on this after finding vulnerabilities in timescaledb to ensure similar vulnerabilities don't reappear. While working on this i found vulnerabilities in over 30 extensions and some of the findings even lead to postgres upstream changes to reduce attack surface of extension scripts (…
In plain words
Pgspot is a Python-based security tool that scans PostgreSQL extension SQL scripts and security definer functions for vulnerabilities. It parses SQL code using libpg_query and analyzes the abstract syntax tree to detect vulnerable patterns. The tool is designed for database developers and extension maintainers who need to identify security issues before deployment. It has already discovered vulnerabilities in over 30 extensions and contributed to upstream PostgreSQL security improvements.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
Hi HN! My name is Sven, I am an engineer at Timescale and this is my fun side project. The main purpose of pgspot is to check postgres extension sql scripts for vulnerabilities but it can also be used to check functions outside of extension context e.g. security definer functions. I've started working on this after finding vulnerabilities in timescaledb to ensure similar vulnerabilities don't reappear. While working on this i found vulnerabilities in over 30 extensions and some of the findings even lead to postgres upstream changes to reduce attack surface of extension scripts ( https://www.postgresql.org/support/security/CVE-2022-2625/ ). pgspot is implemented in python and uses libpg_query to parse sql and analyzes the AST to find vulnerable patterns.
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, November 2024
the whole month →
- IB
I wasn't quite sure if this qualified as "Show HN" given you can't really download it and try it out. However, dang said[0]: > If it's hardware or something that's not so easy to try out over the internet, find a different way to show how it actually works—a video, for example, or a detailed post with photos. Hopefully I did that? Additionally, I've put code and a detailed guide for the netboot computer management setup on GitHub: https://github.com/kentonv/lanparty Anyway, if this shouldn't have been Show HN, I apologize! [0]…
Dev tools · 2024 · lanparty.house
