Pgspot – Find vulnerabilities in Postgres SQL scripts

In plain words

Pgspot is a Python-based security tool that scans PostgreSQL extension SQL scripts and security definer functions for vulnerabilities. It parses SQL code using libpg_query and analyzes the abstract syntax tree to detect vulnerable patterns. The tool is designed for database developers and extension maintainers who need to identify security issues before deployment. It has already discovered vulnerabilities in over 30 extensions and contributed to upstream PostgreSQL security improvements.

written from the facts on this page · September 2026

From the sources

Spot vulnerabilities in postgres SQL scripts. Contribute to timescale/pgspot development by creating an account on GitHub.

pgspot checks extension scripts for following PostgreSQL security best practices. In addition to checking extension scripts it can also be used to check security definer functions or any other PostgreSQL SQL code. Consult the reference for detailed documentation of the vulnerabilities which pgspot detects, and their potential mitigations. To install the runtime requirements, use pip install -r requirements.txt . > pgspot -h usage: pgspot [-h] [-a] [--proc-without-search-path PROC] [--summary-only] [--plpgsql | --no-plpgsql] [--explain EXPLAIN] [--ignore IGNORE] [--sql-accepting SQL_FN] [FILE ...] Spot vulnerabilities in PostgreSQL SQL scripts positional arguments: FILE file to check for…from github.com

In the maker’s words, at launch

Hi HN! My name is Sven, I am an engineer at Timescale and this is my fun side project. The main purpose of pgspot is to check postgres extension sql scripts for vulnerabilities but it can also be used to check functions outside of extension context e.g. security definer functions. I've started working on this after…

• PE
  Pg-extend-rs – Easy Postgres extensions in Rust2018 · bluejekyll.github.io · ▲244
• 
  pg_netstat, a Postgres extension to monitor database network traffic2022 · github.com · ▲158

  pg_netstat is a Postgres extension to monitor database network traffic. It uses libpcap to capture packets and aggregates at user-specified interval.

• 
  Postgres as a VectorDB GUI2024 · github.com · ▲162

  Contribute to Z-Gort/Reservoirs-Lab development by creating an account on GitHub.

• 
  PgQueuer – Transform PostgreSQL into a Job Queue2024 · github.com · ▲376

  PgQueuer is a Python job queue that uses PostgreSQL for everything — queue storage, locking, notifications. No Redis, no RabbitMQ, no separate broker to operate. If your app already has Postgres, you already have the broker. After ~2 years and 26 minor releases, 1.0 ships today as the first stable release. Strict semver from here on. Thanks to everyone who contributed and left feedback!

• 
  PgDog – Scale Postgres without changing the appFeb 2026 · github.com · ▲326

  Hey HN! Lev and Justin here, authors of PgDog (https://pgdog.dev/), a connection pooler, load balancer and database sharder for PostgreSQL. If you build apps with a lot of traffic, you know the first thing to break is the database. We are solving this with a network proxy that works without requiring application code changes or database migrations. Our post from last year: https://news.ycombinator.com/item?id=44099187 The most important update: we are in production. Sharding is used a lot, with direct-to-shard queries (one shard per query) working pretty much…

• 
  sql_firewall – SQL Firewall Extension for PostgreSQL2015 · github.com · ▲47

  SQL Firewall Extension for PostgreSQL. Contribute to uptimejp/sql_firewall development by creating an account on GitHub.

• 
  /dev/null▲487

  a social network for devs

  Dev tools · 3d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 28d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 26d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 23d ago · openbot.run

• 
  Talanoa▲346

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 21d ago · talanoa.email

• 
  CoreSpeed▲332

  One MCP for everything your agents need: apps, memory, tools

  Dev tools · 28d ago · corespeed.io

• 
  Lovable▲1,477

  Hey HN! Previous CERN physicist turned hacker here. We've developed a way to make AI coding actually work by systematically identifying and fixing places where LLMs typically fail in full-stack development. Today we're launching as Lovable (previously gptengineer.app) since it's such a big change. The problem? AI writing code typically make small mistakes and then get stuck. Those who tried know the frustration. We fixed most of this by mapping out where LLMs fail in full-stack dev and engineering around those pitfalls with prompt chains. Thanks to this, in all comparisons I found with: v0,…

  AI · 2024 · lovable.dev

• 
  Superchat▲1,427

  AI Agents for WhatsApp Business, Instagram & Co

  Growth · 2024 · superchat.com

• 
  Postiz▲1,188

  Streamline your social media with Postiz. Schedule posts, analyze performance, and manage all accounts in one place.

  Dev tools · 2024 · postiz.com

• 
  I built a(nother) house optimized for LAN parties▲1,117

  I wasn't quite sure if this qualified as "Show HN" given you can't really download it and try it out. However, dang said[0]: > If it's hardware or something that's not so easy to try out over the internet, find a different way to show how it actually works—a video, for example, or a detailed post with photos. Hopefully I did that? Additionally, I've put code and a detailed guide for the netboot computer management setup on GitHub: https://github.com/kentonv/lanparty Anyway, if this shouldn't have been Show HN, I apologize! [0]…

  Dev tools · 2024 · lanparty.house

• 
  Raycast Notes▲1,058

  Unlock a new level productivity with AI, Cloud Sync and more

  Work · 2024 · raycast.com

• 
  Cap▲1,047

  Beautiful screen recordings, owned by you. 100% open source.

  Dev tools · 2024 · cap.so