shouldiuse.io

Categories

VERDICT

PostgREST Review

Depends

Should I use PostgREST?

PostgREST 16 - postgrest.com

· 6 days ago

Adopt it if your team knows Postgres well and wants a free, instant REST API straight from your database. Skip it if you need vendor support, managed hosting, or complex business logic beyond CRUD.

Confidence

Medium. Based on ~40 public sources; many snippets were truncated, limiting quote depth.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo vendor support evidence found.
  • Security posture

Pricing

$0

Open source (self-hosted)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Postgres-fluent backend teams
  • Internal tools and admin panels
  • CRUD-heavy apps and MVPs
  • Database-first SaaS backends

Not for

  • Teams without Postgres or row-level-security expertise
  • Apps needing rich business logic beyond CRUD
  • Buyers wanting vendor SLAs or support contracts
  • Non-technical teams wanting a no-code API builder

Gotchas - check before you buy

high

Misconfigured deployments have enabled cross-tenant authorization bypasses (Capgo incident, 2026).

high

Security leans on row-level security; one bad GRANT exposes data.

medium

No commercial support — you depend on community help and your own Postgres skills.

medium

Beyond CRUD, complex reporting and business logic get awkward, per detractors.

Pros and cons

Pros

  • Serves a full RESTful API from any Postgres database, automatically.
  • Completely free and open source — no paid tiers at all.
  • Powers Supabase's data API, so it's battle-tested in production.
  • Security model built on database roles and row-level security.
  • HN commenters call it more secure than most hand-rolled API servers.

Cons

  • Critics say it breaks down for complex apps beyond simple CRUD.
  • No vendor support; purely community-maintained open source.
  • Auth setup is nontrivial; long GitHub discussions on authorization options.
  • Reviewers warn it isn't magic — expect real configuration work.

Sources & method

- 12 sources - No CVEs found for PostgREST core in reviewed sources; one reported RPC info-disclosure issue and misconfiguration risks in products built on it.

official x4review x5security x2news x1
  • Information disclosure in RPC function error handling, Reported March 2025 on the PostgREST repo; error handling in RPC functions could leak information.
  • Cross-tenant bypass in Capgo (built on PostgREST), Capgo before 12.128.2, not PostgREST core, allowed cross-tenant authorization bypass via PostgREST webhook/RPC access.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. Completely free and open source.
  • Ease of use: 3/5. Instant API once running; config demands Postgres fluency.
  • Feature depth: 4/5. Full REST API: filtering, embedding, RPC, auth.
  • Support quality. No vendor support evidence found.
  • Security posture: 3/5. Strong design, but depends on correct RLS setup.
  • $0 Price Open source, self-hosted
  • Yes Free tier Entire project is free
  • 16 Latest version PostgREST 16
  • 50 Alternatives tracked Listed on StackShare

Pricing

Open source (self-hosted)

$0

  • Full REST API server
  • Community support only
  • You host, run, and secure it

Security

No CVEs found for PostgREST core in reviewed sources; one reported RPC info-disclosure issue and misconfiguration risks in products built on it.

  • Information disclosure in RPC function error handlingReported March 2025 on the PostgREST repo; error handling in RPC functions could leak information.⁹
  • Cross-tenant bypass in Capgo (built on PostgREST)Capgo before 12.128.2, not PostgREST core, allowed cross-tenant authorization bypass via PostgREST webhook/RPC access.10

What users say

Developers praise it as a fast, secure way to ship APIs over Postgres, but warn it's not magic and weakens on complex app logic.

“PostgREST is far more secure than most API servers.”
Hacker News
“In reality postgREST sucks... it's fine for simple apps, but for...”
Hacker News

Alternatives

Compare PostgREST with each alternative.

  • Supabase

    Hosted Postgres bundling PostgREST with auth and storage managed.

    PostgREST vs Supabase

  • DreamFactory

    Commercial API-generation platform with vendor support included.

  • pREST

    Alternative Postgres-to-REST server, lighter-weight option.

Companies that use it

Full analysis

Based on ~40 public sources; many snippets were truncated, limiting quote depth.

Free, excellent API-over-Postgres for Postgres-fluent devs; wrong pick if you need support, hosting, or complex app logic.

Methodology

Based on ~40 public sources; many snippets were truncated, limiting quote depth.

Read how a report is made.

Sources

  1. PostgREST/postgrest: REST API for any Postgres databasegithub.com
    official
  2. Database Authorization — PostgREST docsdocs.postgrest.org
    official
  3. Hardening PostgRESTdocs.postgrest.org
    official
  4. PostgREST Review 2026: Features, Pricing and Alternativesgappsy.com
    review
  5. PostgREST | The Open Source Dropopensourcedrop.com
    review
  6. In reality postgREST sucks... it's fine for simple appsnews.ycombinator.com
    review
  7. PostgREST is far more secure than most API serversnews.ycombinator.com
    review
  8. Using PostgREST? What would you improvereddit.com
    review
  9. Information disclosure in RPC function error handlinggithub.com
    security
  10. Capgo cross-tenant authorization bypass via PostgRESTvulncheck.com
    security
  11. Supabase Data REST API docssupabase.com
    official
  12. Faucet vs PostgRESTfaucetdb.ai
    news

Add this review to your site

This check for PostgREST says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends PostgREST Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.