Static security gate for Postgres extensions, before they ever touch a database
Postgres extensions cross a brutal trust boundary: install scripts can run with elevated privileges, and native modules execute inside the server process. PgExtAssure scans an extension's full source tree before that decision, flags security-relevant patterns, and can fail CI at a chosen severity. It never builds, installs, or runs what it inspects, so the evidence is reproducible without touching a live database. No hosted account or telemetry, and public runs from independently controlled forks back the claim.