Pgspot – Find vulnerabilities in Postgres SQL scripts

Hacker News

Hi HN! My name is Sven, I am an engineer at Timescale and this is my fun side project. The main purpose of pgspot is to check postgres extension sql scripts for vulnerabilities but it can also be used to check functions outside of extension context e.g. security definer functions. I've started working on this after finding vulnerabilities in timescaledb to ensure similar vulnerabilities don't reappear. While working on this i found vulnerabilities in over 30 extensions and some of the findings even lead to postgres upstream changes to reduce attack surface of extension scripts ( https://www.postgresql.org/support/security/CVE-2022-2625/ ). pgspot is implemented in python and uses libpg_query to parse sql and analyzes the AST to find vulnerable patterns.

Visit product View on Hacker NewsNov 21, 2024

Share card

Actual performance

13points

Made the leaderboard

Launch Intel predictions

Analyze your own launch →

Hacker NewsStrong engagement from HN community · Strong signals: ide, io · Missing: https docs, excited, just released

63%63% predicted probability of success on Hacker News, based on ML models trained on real launch data.

nativeThis product was originally launched on this platform.

Indie HackersFits the IH revenue-focused audience · Strong signals: started · Missing: supports, reddit linkedin, podcasting

50%50% predicted probability of success on Indie Hackers, based on ML models trained on real launch data.

AppSumoMay struggle as an AppSumo deal · Missing: plus, platform, intuitive

47%47% predicted probability of success on AppSumo, based on ML models trained on real launch data.

Product HuntUnlikely to reach the leaderboard · Strong signals: context · Missing: mac, agents, macos

45%45% predicted probability of success on Product Hunt, based on ML models trained on real launch data.

TrustMRRLess likely to generate early MRR · Missing: mobile apps, ios, personal

35%35% predicted probability of success on TrustMRR, based on ML models trained on real launch data.

Acquire.comPre-revenue stage for this audience · Missing: arr, mrr, revenue

16%16% predicted probability of success on Acquire.com, based on ML models trained on real launch data.

BetaListMay not resonate with beta-testers · Missing: web3, chat, crypto

1%1% predicted probability of success on BetaList, based on ML models trained on real launch data.

Correct prediction on native model

Similar products

SQL Runner, Run Playbooks of SQL Scripts on Postgres and Redshift72%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

SQL Runner, Run Playbooks of SQL Scripts on Postgres and Redshift

Hacker News1

PgTyped – Typesafe SQL in TypeScript and Postgres70%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

PgTyped – Typesafe SQL in TypeScript and Postgres

Hacker News269

pg_raw_parse – parse SQL in Rust at Postgres speed62%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

pg_raw_parse – parse SQL in Rust at Postgres speed

Hacker News1

PgModeler – EER Diagramming for postgres73%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

PgModeler – EER Diagramming for postgres

Hacker News9

Merging RethinkDB and Postgres with GraphQL79%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Merging RethinkDB and Postgres with GraphQL

Hacker News6

First experiment wih Vertx,Vue,Postgres48%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

First experiment wih Vertx,Vue,Postgres

Hacker News1

Logchain – ClickHouse/Postgres gRPC hook for logrus81%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Logchain – ClickHouse/Postgres gRPC hook for logrus

Hacker News3

pglockanalyze - See the locks your Postgres migrations will acquire59%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

pglockanalyze - See the locks your Postgres migrations will acquire

Hacker News8

Now supporting MySQL, Postgres, Redis, Mongo60%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

Now supporting MySQL, Postgres, Redis, Mongo

Hacker News3

GraphQL for Postgres83%Launch Intel prediction score: how likely this product is to succeed on its source platform, based on its name, tagline, and description.

GraphQL for Postgres

Hacker News195

Browse all products Analyze your launch