PostgreSQL Rules | BeforeMerge

Pricing Blog Contributors Install Guide

Explore
PostgreSQL

PostgreSQL

v1.0.0

Lint PostgreSQL schemas, migrations, and functions using splinter, squawk, plpgsql_check, and pgTAP.

18 rules

4 categories

Security(3)

Auth Users Table Exposed to API

The auth.users table is accessible through the API schema, leaking user data.

supabaseSplinterDB Linting

Performance(8)

Create Indexes Concurrently

Non-concurrent index creation locks the table for writes during the entire build.

SquawkpostgresqlMigration Safety

Architecture(1)

Tables Must Have Primary Keys

Tables without primary keys cannot use logical replication and have degraded query performance.

Schema DesignSplinterpostgresql

Quality(6)

Prefer identity columns (or uuid) over serial

Use GENERATED ... AS IDENTITY or uuid for surrogate keys instead of the legacy serial pseudo-type.

Use timestamptz, not timestamp, for points in time

Store points in time as timestamptz so values are unambiguous across time zones and DST.

Prefer text over varchar(n)

Use text (optionally with a CHECK) instead of varchar(n); the length cap adds no performance benefit.

Automate PostgreSQL checks on every PR

BeforeMerge scans your pull requests against all 18 PostgreSQL rules automatically. Get actionable feedback before code ships.

Join Waitlist Browse All Rules

AI-native code review knowledge base. Structured rules that catch what linters miss.

Product

Features
Explore
Pricing
Docs
GitHub

Company

About
Blog
Contributors
Contributing

Legal

Privacy Policy
Terms of Service
MIT License

© 2026 BeforeMerge. Built by

RLS Disabled on Public Tables

Tables in the public schema without Row Level Security allow unrestricted access through the API.

SplinterrlsDB Linting

CRITICAL

Mutable Search Path in Functions

Functions without a fixed search_path are vulnerable to search path injection attacks.

plpgsql_checkSplinterpostgresql

Add NOT NULL Constraint Safely

Adding NOT NULL to an existing column requires a full table scan and exclusive lock.

SquawkpostgresqlMigration Safety

HIGH

Avoid long-held locks in migrations

Set a lock_timeout, split steps, and add columns nullable-then-backfill to keep migration locks short.

Unindexed Foreign Keys

Foreign key columns without indexes cause slow JOINs and cascade operations.

SplinterDB Lintingpostgresql

Use jsonb, not json

Store JSON documents as jsonb to get binary storage, indexing, and efficient operators.

Use partial and expression indexes for filtered queries

Index only the rows or computed expressions your queries actually filter on to cut index size and speed lookups.

Be autovacuum-aware on high-churn tables

Tune autovacuum per-table on high-churn tables so dead tuples and bloat don't degrade performance.

Add constraints NOT VALID then VALIDATE on big tables

Add FK and CHECK constraints as NOT VALID, then VALIDATE CONSTRAINT separately to avoid a long blocking scan.

Use CHECK constraints to enforce invariants

Encode column and row invariants as CHECK constraints so bad data is rejected at the database.

MEDIUM

Use NUMERIC for money, never float

Store monetary amounts as numeric/decimal so values are exact; binary floats introduce rounding errors.

Use generated (stored) columns for derived values

Compute derived values with GENERATED ALWAYS AS ... STORED instead of duplicating logic in every writer.

Features Explore

Rules Skills Knowledge Prompts

Pricing Blog Contributors Install Guide

PostgreSQL Linting & Analysis

A comprehensive review skill for PostgreSQL databases covering schema security, migration safety, function validation, and performance auditing.

Tools Covered

Splinter — Supabase schema linter (security, RLS, performance)
Squawk — Migration safety linter (locks, downtime)
plpgsql_check — PL/pgSQL static analysis
pgTAP — Schema testing framework
schemalint — Naming convention enforcement
SQLFluff — SQL formatting and style

Applicable Platforms

Supabase (hosted & self-hosted)
Neon
Amazon RDS / Aurora PostgreSQL
Google Cloud SQL for PostgreSQL
Azure Database for PostgreSQL
Self-managed PostgreSQL