electric-postgres-security
Pre-deploy security checklist for Postgres with Electric. Checks REPLICATION role, SELECT grants, CREATE on database, table ownership, REPLICA IDENTITY FULL on all synced tables, publication management (auto vs manual with ELECTRIC_MANUAL_TABLE_PUBLISHING), connection pooler exclusion for DATABASE_URL (use direct connection), and ELECTRIC_POOLED_DATABASE_URL for pooled queries. Load before deploying Electric to production or when diagnosing Postgres permission errors.
Best use case
electric-postgres-security is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Pre-deploy security checklist for Postgres with Electric. Checks REPLICATION role, SELECT grants, CREATE on database, table ownership, REPLICA IDENTITY FULL on all synced tables, publication management (auto vs manual with ELECTRIC_MANUAL_TABLE_PUBLISHING), connection pooler exclusion for DATABASE_URL (use direct connection), and ELECTRIC_POOLED_DATABASE_URL for pooled queries. Load before deploying Electric to production or when diagnosing Postgres permission errors.
Teams using electric-postgres-security should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/electric-postgres-security/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How electric-postgres-security Compares
| Feature / Agent | electric-postgres-security | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Pre-deploy security checklist for Postgres with Electric. Checks REPLICATION role, SELECT grants, CREATE on database, table ownership, REPLICA IDENTITY FULL on all synced tables, publication management (auto vs manual with ELECTRIC_MANUAL_TABLE_PUBLISHING), connection pooler exclusion for DATABASE_URL (use direct connection), and ELECTRIC_POOLED_DATABASE_URL for pooled queries. Load before deploying Electric to production or when diagnosing Postgres permission errors.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
This skill builds on electric-proxy-auth. Read it first for proxy security patterns.
# Electric — Postgres Security Checklist
Run through each section before deploying Electric to production.
## User Permission Checks
### Check: Electric user has REPLICATION role
Expected:
```sql
SELECT rolreplication FROM pg_roles WHERE rolname = 'electric_user';
-- Should return: true
```
Fail condition: `rolreplication = false` or user does not exist.
Fix: `ALTER ROLE electric_user WITH REPLICATION;`
### Check: Electric user has SELECT on synced tables
Expected:
```sql
SELECT has_table_privilege('electric_user', 'todos', 'SELECT');
-- Should return: true
```
Fail condition: Returns `false`.
Fix: `GRANT SELECT ON todos TO electric_user;` or `GRANT SELECT ON ALL TABLES IN SCHEMA public TO electric_user;`
### Check: Electric user has CREATE on database
Expected:
```sql
SELECT has_database_privilege('electric_user', current_database(), 'CREATE');
-- Should return: true (unless using manual publishing mode)
```
Fail condition: Returns `false` and not using `ELECTRIC_MANUAL_TABLE_PUBLISHING=true`.
Fix: `GRANT CREATE ON DATABASE mydb TO electric_user;`
## Table Configuration Checks
### Check: REPLICA IDENTITY FULL on all synced tables
Expected:
```sql
SELECT relname, relreplident
FROM pg_class
WHERE relname IN ('todos', 'users')
AND relreplident = 'f'; -- 'f' = FULL
```
Fail condition: `relreplident` is `'d'` (default) or `'n'` (nothing).
Fix: `ALTER TABLE todos REPLICA IDENTITY FULL;`
### Check: Tables are in the Electric publication
Expected:
```sql
SELECT tablename FROM pg_publication_tables
WHERE pubname = 'electric_publication_default';
```
Fail condition: Synced tables missing from the list.
Fix (manual mode): `ALTER PUBLICATION electric_publication_default ADD TABLE todos;`
## Connection Checks
### Check: DATABASE_URL uses direct connection (not pooler)
Expected:
```
DATABASE_URL=postgres://user:pass@db-host:5432/mydb
```
Fail condition: URL points to a connection pooler (e.g., PgBouncer on port 6432, Supabase pooler).
Fix: Use direct Postgres connection for `DATABASE_URL`. Set `ELECTRIC_POOLED_DATABASE_URL` separately for pooled queries.
### Check: wal_level is set to logical
Expected:
```sql
SHOW wal_level;
-- Should return: logical
```
Fail condition: Returns `replica` or `minimal`.
Fix: Set `wal_level = logical` in `postgresql.conf` and restart Postgres.
## Common Security Mistakes
### CRITICAL Using connection pooler for DATABASE_URL
Wrong:
```sh
DATABASE_URL=postgres://user:pass@pooler.example.com:6432/mydb
```
Correct:
```sh
DATABASE_URL=postgres://user:pass@db.example.com:5432/mydb
ELECTRIC_POOLED_DATABASE_URL=postgres://user:pass@pooler.example.com:6432/mydb
```
Connection poolers (except PgBouncer 1.23+) do not support logical replication. Electric must connect directly to Postgres for its replication slot.
Source: `website/docs/guides/deployment.md:91`
### HIGH Missing REPLICA IDENTITY FULL on tables
Wrong:
```sql
CREATE TABLE todos (id UUID PRIMARY KEY, text TEXT);
-- Replica identity defaults to 'default' (PK only)
```
Correct:
```sql
CREATE TABLE todos (id UUID PRIMARY KEY, text TEXT);
ALTER TABLE todos REPLICA IDENTITY FULL;
```
Without `REPLICA IDENTITY FULL`, Electric cannot stream the full row on updates and deletes. Updates may be missing non-PK columns.
Source: `website/docs/guides/troubleshooting.md:373`
### HIGH Electric user without REPLICATION role
Wrong:
```sql
CREATE USER electric_user WITH PASSWORD 'secret';
```
Correct:
```sql
CREATE USER electric_user WITH PASSWORD 'secret' REPLICATION;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO electric_user;
```
Electric uses logical replication and requires the `REPLICATION` role on the database user.
Source: `website/docs/guides/postgres-permissions.md`
## Pre-Deploy Summary
- [ ] Electric user has `REPLICATION` role
- [ ] Electric user has `SELECT` on all synced tables
- [ ] Electric user has `CREATE` on database (or manual publishing configured)
- [ ] All synced tables have `REPLICA IDENTITY FULL`
- [ ] All synced tables are in the Electric publication
- [ ] `DATABASE_URL` uses direct Postgres connection (not pooler)
- [ ] `wal_level = logical` in Postgres config
- [ ] `ELECTRIC_SECRET` is set (not using `ELECTRIC_INSECURE=true`)
- [ ] Secrets are injected server-side only (never in client bundle)
See also: electric-proxy-auth/SKILL.md — Proxy injects secrets that Postgres security enforces.
See also: electric-deployment/SKILL.md — Deployment requires correct Postgres configuration.
## Version
Targets Electric sync service v1.x.Related Skills
checking-session-security
This skill enables Claude to check session security implementations within a codebase. It analyzes session management practices to identify potential vulnerabilities. Use this skill when a user requests to "check session security", "audit session handling", "review session implementation", or asks about "session security best practices" in their code. It helps identify issues like insecure session IDs, lack of proper session expiration, or insufficient protection against session fixation attacks. This skill leverages the session-security-checker plugin. Activates when you request "checking session security" functionality.
performing-security-testing
This skill automates security vulnerability testing. It is triggered when the user requests security assessments, penetration tests, or vulnerability scans. The skill covers OWASP Top 10 vulnerabilities, SQL injection, XSS, CSRF, authentication issues, and authorization flaws. Use this skill when the user mentions "security test", "vulnerability scan", "OWASP", "SQL injection", "XSS", "CSRF", "authentication", or "authorization" in the context of application or API testing.
performing-security-audits
This skill allows Claude to conduct comprehensive security audits of code, infrastructure, and configurations. It leverages various tools within the security-pro-pack plugin, including vulnerability scanning, compliance checking, cryptography review, and infrastructure security analysis. Use this skill when a user requests a "security audit," "vulnerability assessment," "compliance review," or any task involving identifying and mitigating security risks. It helps to ensure code and systems adhere to security best practices and compliance standards.
security-policy-generator
Security Policy Generator - Auto-activating skill for Security Advanced. Triggers on: security policy generator, security policy generator Part of the Security Advanced skill category.
finding-security-misconfigurations
This skill enables Claude to identify potential security misconfigurations in various systems and configurations. It leverages the security-misconfiguration-finder plugin to analyze infrastructure-as-code, application configurations, and system settings, pinpointing common vulnerabilities and compliance issues. Use this skill when the user asks to "find security misconfigurations", "check for security vulnerabilities in my configuration", "audit security settings", or requests a security assessment of a specific system or file. This skill will assist in identifying and remediating potential security weaknesses.
responding-to-security-incidents
Assists with security incident response, investigation, and remediation. This skill is triggered when the user requests help with incident response, mentions specific incident types (e.g., data breach, ransomware, DDoS), or uses terms like "incident response plan", "containment", "eradication", or "post-incident activity". It guides the user through the incident response lifecycle, from preparation to post-incident analysis. It is useful for classifying incidents, creating response playbooks, collecting evidence, constructing timelines, and generating remediation steps. Use this skill when needing to respond to a "security incident".
security-headers-generator
Security Headers Generator - Auto-activating skill for Security Fundamentals. Triggers on: security headers generator, security headers generator Part of the Security Fundamentals skill category.
analyzing-security-headers
This skill analyzes HTTP security headers of a given domain to identify potential vulnerabilities and misconfigurations. It provides a detailed report with a grade, score, and recommendations for improvement. Use this skill when the user asks to "analyze security headers", "check HTTP security", "scan for security vulnerabilities", or requests a "security audit" of a website. It will automatically activate when security-related keywords are used in conjunction with domain names or URLs.
security-group-generator
Security Group Generator - Auto-activating skill for AWS Skills. Triggers on: security group generator, security group generator Part of the AWS Skills skill category.
security-benchmark-runner
Security Benchmark Runner - Auto-activating skill for Security Advanced. Triggers on: security benchmark runner, security benchmark runner Part of the Security Advanced skill category.
scanning-database-security
Process use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like "scan for vulnerabilities", "implement security controls", or "audit security".
scanning-container-security
Execute use when you need to work with security and compliance. This skill provides security scanning and vulnerability detection with comprehensive guidance and automation. Trigger with phrases like "scan for vulnerabilities", "implement security controls", or "audit security".