DBX vs SQLTriage

DBX is a web-based security analysis tool for PostgreSQL and Supabase databases. It examines how identities can reach database objects through RLS policies, grants, functions, storage, relationships, and tenant boundaries. DBX inspects live security objects and uses a deterministic rule engine and permission graph to evaluate practical access. It groups individual weaknesses into attack paths and reports severity, confidence, and evidence. Each deterministic finding includes a proposed migration linked to the relevant object, with an expected security effect and compatibility risk. The snapshot contains catalog metadata, including schemas, policies, grants, routines, and relationships, but no database rows. DBX says its snapshot workflow requires no database password, persistent connection, agent, or production write access; scanning is designed for a dedicated least-privilege role with catalog permissions. A language model explains verified findings and drafts remediation for human review. DBX does not test application code, network controls, or client authorization logic, and it makes no compliance certification claims. Free unlimited introspection is available; Full Remediation costs $195, paid once.

SQLTriage audits SQL Server and maps findings to compliance controls, with cited evidence and a PDF for board-level review. It describes more than 576 checks across security, performance, configuration, high availability, backup, and recovery. Mappings cover NIST 800-53, CIS Benchmarks, DISA STIG, ISO 27001, SOC 2, PCI-DSS, and HIPAA. Its read-only assessment queries SQL Server DMVs without installing an agent or changing the schema; separate opt-in deployment and remediation pages can make changes. Companion monitoring views include live sessions, blocking chains, query plans, wait statistics, dashboards, and alerts. The repository says the app is local-only by default, without telemetry, phone-home behavior, or a cloud dependency, and supports optional Azure Blob export. SQL passwords are encrypted at rest with AES-256-GCM and DPAPI. It supports Windows authentication, SQL authentication, and Azure AD. Azure SQL Managed Instance is fully supported; Azure SQL Database has partial support, and checks needing server-level DMV access are skipped automatically. SQLTriage is free under GNU GPL v3, allowing commercial use while requiring modifications to remain open.