Built in the open · no self-serve, no sales team, one founder
Your customer’s spreadsheet should never be able to write a tenant_id.
Every CSV a customer sends you is untrusted input pointed at production. ImportFlow reads your actual Postgres catalog and tells you what that file can safely fill in — and which columns it must never touch. Derived from your schema. Not re-typed into someone’s dashboard.
01excel silently turned 3 product codes into dates
02"Active", "active", "ACTIVE" — your enum accepts exactly one
03the file has an account_id column. so does your table. they must never meet
04the insert fires a trigger. the trigger sends email. there are 4,000 rows
05job died at row 2,000 — which of rows 1–1,999 actually landed?
──none of this is exotic. it’s tuesday.
zero-trust, literally
The architecture assumes you shouldn’t trust me. Because you shouldn’t.
No service_role key. Ever.
Your Supabase secret key maps to service_role, which bypasses RLS entirely. Whoever holds it owns your database, and their breach becomes your incident. The architecture decision record for this project rejected that model on the record — it would have shipped months faster. Still no.
The check reads text, not your database.
You paste a CREATE TABLE. No connection string, no OAuth grant, no “read-only” key that turns out to be service_role. Nothing leaves your control, because nothing is requested.
Your schema is the spec.
Re-typing your columns into a vendor dashboard gives you a second schema, and second schemas drift. The import path here is derived from your live catalog — constraints, enums, triggers, generated columns, and the fields that must come from the session, never from the file.
Refusal is a feature.
A table shape I can't handle safely gets a refusal with a stated reason — not a best-effort guess that detonates at row 2,000. Every milestone behind this ships through independent adversarial review, findings against my own work included. Want to read them? Ask.
What’s actually built (a shorter list than the vision)
Schema fingerprinting. Catalog analysis. A contract compiler that emits a reviewable, deliberately non-executable description of a proposed import. The part that generates SQL lives behind a review gate and stays off until it passes — that’s the point, not a delay. No widget, no self-serve, no automated writes. If this page ever claims more than the repo proves, call me on it. Today, an import is the two of us: my analysis, your authority, your environment.
Send your table. Get the analysis.
Paste your CREATE TABLE below — sanitized is fine. Within 24 hours you get back: which columns a customer file can safely fill, which are tenant- or session-bound and must never come from the file, and which constraints, enums, and triggers will bite you mid-import. No credentials, no connection, no signup. It's me doing the analysis for now, and that's a feature.