Backend-as-a-service rules
Firebase/Firestore/Storage rules allowing read/write to any signed-in or anonymous user; Supabase tables without RLS.
The pack · 09 / 14 →
Database
Dachshund
the database dog. Digs into migrations, row-level security, DB roles and Firebase/Supabase rules.
004.sql
12create table orders (
13 id uuid primary key, user_id uuid, total int
14);
15alter table orders disable row level security;alter table orders enable row level security;
16
Row-level security off
ExploitAny signed-in user can read every order
FixSmallest change suggested
Dachshund is watching$ /watchdog-go-database0 found · 0 fixed
What it does
On duty while you build.
The database dog. Digs into schemas, migrations, row-level security, database roles and Firebase/Supabase rules.
The always-on lens watches SQL migrations, ORMs, Postgres, MySQL, Supabase, Firebase rules, Firestore, MongoDB.
What it checks
7 things Dachshund looks for.
Row-level security
RLS disabled or policies using client-controlled values; service-role key used client-side.
Roles and grants
app connecting as superuser/owner, `GRANT ALL`, shared credentials across services.
Sensitive columns
passwords, tokens, government ids stored unencrypted or unhashed.
Migrations
destructive changes without backup, locks on hot tables, data backfills exposing data.
Exposure
databases reachable from the internet, default ports and credentials, no TLS.
Injection surface
raw queries in ORMs, dynamic identifiers built from input.
Commands
Send Dachshund out.
Runs these scanners when installed, then reads the code they can't understand:
- squawk
- semgrep
Migrations, row-level security, DB roles, Firebase/Supabase rules, encryption
- /watchdog-go-web
- /watchdog-go-mobile
- /watchdog-go-marketplace
- /watchdog-go-all
Also runs in these bundles.
Benchmark
Tested, not promised.
Its test target holds Supabase migrations, Firestore/Storage rules, DB roles and client code: 18 planted issues, 4 decoys and an answer key.
found
Haiku 5.517/18
Sonnet 5.517/18
Opus 5.518/18
Rules of engagement
What Dachshund will never do.
- 1
Static review only. Never change live systems or send traffic to targets outside the user's written scope.
- 2
Never print a secret's value — not keys, tokens or passwords, even weak defaults. Give file:line and the secret type only.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Dachshund, answered.
What does Dachshund check for?
Dachshund is Watchdog's database dog for Claude Code. It looks for Backend-as-a-service rules, Row-level security, Roles and grants, Sensitive columns, Migrations, Exposure and Injection surface. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Dachshund in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-database. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Dachshund use?
When they're installed, Dachshund runs squawk and semgrep, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Dachshund safe to run on my project?
Yes. Its first rule: Static review only. Never change live systems or send traffic to targets outside the user's written scope. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).