BareSQL 0.3.0 lets one audit cover a whole PostgreSQL server. With --all-databases, or --database given more than once, each database is read in its own read-only transaction, and the report shows every login once with what it can read in all of them, plus the databases it may not connect to.
The audit also reads simple row security conditions now. A policy of true is reported as letting every row through, and a condition on the role’s name, a constant or a session setting is spelled out on the route. A new finding, rls-session-setting, flags policies that pick the tenant from a setting such as app.tenant_id, which any session can change with SET. An independent review went over the new code twice before the release. The release post has the details.