BareSQL is the studio’s thirty-sixth project: one program, baresql, with two tools in it. BareSQL Audit works out which PostgreSQL login can read which column, and by which route. BareSQL Portable looks for SQL that SQLite, PostgreSQL, MySQL and MariaDB don’t agree on. The launch post introduces both.
The audit follows access through roles at any depth, SET ROLE, ownership, pg_read_all_data, views and row security. Then it checks its answer for every column against the server’s own privilege functions and reports any disagreement. Personal data is recognized from column names and sampled values, and the values never reach the report. With --baseline, a scheduled job fails on the day any login can reach more than before. One case study audits an AI support agent’s login before it goes live and finds a view that would show it customers’ names and email addresses in every tenant.
Portable knows 58 differences, each with what to write instead where a fix exists, and the 1,212 answers it quotes were recorded on the four engines themselves. baresql compare runs a script on the engines and lists the statements whose answers differ. In the case of an app tested on SQLite, six queries fail on PostgreSQL and two more run there with different answers.
The tests run on six PostgreSQL versions, three of MySQL and four of MariaDB. Five test databases planted with leaks and near misses are checked line by line on each PostgreSQL version. An independent review before the release tried to break both tools, and what it found was fixed with a test of its own or written down as a known limit. Like PXTA, it gives a privacy team evidence taken from the system itself.
Open source under Apache 2.0, with releases for Linux, macOS and Windows.