Available for PostgreSQL

Tenant isolation testing

Row-Level Security and careful function logic keep tenant A from seeing tenant B. Two layers, each needing its own proof, every release.

Policies proven per table, command and identity
Functions, views and triggers judged per routine
Witnessed evidence of table, command and channel
PII in error messages caught

How to do it

Start free with rlsautotest for the policies. seccover covers the policies and the code in one run.

Policies only, free. rlsautotest tests every RLS policy, per table, command and identity.

pip install rlsautotest
rlsautotest --db-url "$DATABASE_URL" --schema public --html rls-report.html
# or emit a committable pgTAP suite:
rlsautotest --db-url "$DATABASE_URL" --schema public --emit supabase/

Policies and code, Enterprise. seccover tests the RLS policies with an improved version of the rlsautotest checks, plus the functions, views and triggers that bypass them.

unitautogen seccover --schema public --out sec_out --sec-html sec.html --sec-json sec.json --sec-gate

--sec-gate exits non-zero when a leak is found, to fail CI
rlsautotest is free (Apache-2.0); seccover needs an Enterprise licence

Two layers where tenant data leaks

A test at one layer says nothing about the other.

The policy layer, where Row-Level Security governs direct table access
The code layer, where SECURITY DEFINER functions, views and owner-run triggers bypass RLS by design

rlsautotest

Policy layer

Proves each RLS policy, per table, per command and per identity
Fails CI on a reachable table with no policy
Names every SECURITY DEFINER function, view and trigger as a suspect

It cannot judge the suspects; it sees that code bypasses RLS, not whether it leaks.

rlsautotest, free and open source →

UnitAutogen seccover

Policy and code layers

Tests every RLS policy, an improved version of the rlsautotest checks
Runs each suspect as two tenants with generated data on both sides
A verdict per routine, enforced or leaking, with the table, command and channel
A PII pass for personal data escaping through error messages

Covers both layers in one run, in the Enterprise edition.

seccover, in the UnitAutogen engine →

Start free with rlsautotest for the policies. Use seccover to cover both layers.

rlsautotest is a separate free, open-source tool for RLS policies
seccover tests the policies and the functions, views and triggers that bypass them

seccover, in the engine rlsautotest, free

What platforms suggest

Both layers of isolation, and testing them, come straight from the platforms' docs.