A New Postgres Safety Checker Meets Its Limits on Hacker News

A browser-only tool called Safe-Not-Safe, posted to Hacker News on Sept. 26, reads a Postgres migration file and labels it safe or not safe without sending any of the SQL off the page. Its creator, Vignesh Ravichandran, said in the discussion that he led Cloudflare's Postgres platform team from 2019 to 2023, supporting more than 170 product teams that kept asking for exactly this kind of review before running a migration.

The Hacker News thread reached 81 points within hours, with Ravichandran posting the top comment himself. Safe-Not-Safe parses SQL with libpg-query-node, a Postgres grammar compiled to WebAssembly, so the check runs entirely in the visitor's browser with no account and no logging. The rule engine is a port of pg_savior, a Postgres extension Ravichandran built in January 2024 that has 85 stars on GitHub. Safe-Not-Safe's own repository, published Aug. 14, had 17 stars as of Saturday.

The tool catches rules, not database state

Ravichandran said the deterministic approach can only go so far. "The decision of safe vs not-safe depends heavily on data/histogram and edge cases, but still quite a lot of low-hanging issues can be easily caught with a deterministic rule engine," he wrote in the thread. The example migration shown on the site adds a column and a concurrent index, and the parser flags zero statements as unsafe.

A rebuttal arrived within hours

A commenter using the handle orf, maintainer of a rival project called Locksmith, said rule-based checkers cannot know what a migration will actually do without seeing the database it targets. "Altering a column type is either a no-op or an exclusive locked table rewrite depending on the original type of the column," orf wrote, adding that altering a foreign key column can lock more than one table at once. Locksmith instead introspects a live schema and asks Postgres directly what a given migration will do, which orf said accounts for the size and activity of the table being changed in a way a static ruleset cannot.

Tool	Approach	GitHub stars
Safe-Not-Safe	Static rules on migration text, entirely client-side	17
Locksmith	Introspects a live schema, asks Postgres what a migration does	41
Reshape	Zero-downtime engine, runs old and new schema during rollout	1,853
strong_migrations	Ruby library of rule-based checks with explanations	4,450

Other commenters pointed to tools built years earlier

Commenter nijave named strong_migrations, a Ruby library by developer Andrew Kane that has run in production Rails apps for years. Commenter fabianlindfors named his own project, Reshape, which he said supports zero-downtime application rollouts by running the old and new database schema side by side during a deployment rather than only checking the migration text ahead of time. The debate joins a broader pattern of scrutiny on Postgres tooling, following PlanetScale's own benchmark of a search extension against ParadeDB and a comparison of three competing approaches to durable execution built on Postgres.

What's next

Two requests from the thread have no public answer yet. Commenter paol suggested packaging Safe-Not-Safe as a command-line tool for CI pipelines rather than a browser page. Commenter necovek asked for named safety profiles, such as backwards-compatible, revertable or destructive, instead of a single yes-or-no verdict. Ravichandran had not replied to either suggestion as of Saturday afternoon, and Safe-Not-Safe's site does not carry a public roadmap.