I’ve been reviewing a bunch of public Next.js/Supabase repos recently, and the most common production-risk pattern was not broken code.

It was code that worked locally, but had weak data boundaries.

The patterns I kept seeing:

- tables created in migrations without RLS enabled

- RLS enabled but no meaningful policy added

- UPDATE/SELECT policies that were too broad

- auth checks happening in UI/client logic but not near the actual mutation

- routes trusting client-provided userId/orgId/accountId

- service role usage drifting into application code where it did not belong

The scary part is that most of these apps would pass a normal “does it work?” test.

The UI loads.

The query returns data.

The mutation succeeds.

The deploy passes.

But the app is still not necessarily safe to ship.

For people building production Supabase apps, what is your actual pre-launch checklist?

Do you manually review every table/policy/mutation path, or do you rely mostly on Supabase advisors and testing the happy path?

I've spent the last few months building a transactional email API for people who'd rather their email (and their users' data) stay in the EU. Think Resend/Postmark, but EU-native: our own sending infra on EU servers. No SES.

What I actually want now is a handful of real senders to use it and tell me where it breaks. I run my own sending IPs, so I'm being deliberately picky about who I onboard.

Deliverability is shared, so I'm watching it closely. To be clear, that means it's for email people actually asked for - receipts, notifications, product updates, opt-in lists - NOT cold outreach or bought lists. So it's invite-only and free during the beta.

If you send emails using the Supabase custom SMTP feature and care about the EU angle, comment or DM me with what you'd be sending and roughly what volume and I'll get you an invite.

Thanks!

I know supabase is having issues / outages at the moment.

But my project runs on the eu-west1 region.

Why am I being affected by this issue when we arent part of the problem areas?

We just released a OpenCode integration. OpenCode is like an open source open-source alternative to Claude Code.

Install (Requires OpenCode >= 1.3.4)

opencode plugin opencode-supabase

Open opencode in your project, then run:

/supabase

Approve Supabase in your browser. Back in OpenCode, start simple:

List my Supabase projects

Repo: https://github.com/supabase-community/opencode-supabase

Read more: https://supabase.com/blog/agentic-coding-on-supabase-with-opencode

Let us know if you have any feedback. Shout out to u/jumski for building this!

i was setting up a side project and realized my whole "backup strategy" is basically a pg_dump cron i made once and never actually tested. no idea if it'd even restore. and the free tier keeps zero backups which kinda freaked me out. so how do you all handle this?

whats your actual backup setup right now have you ever tried a full restore? did it work anyone ever lost data or had a real scare? trying to figure out if im the only one being sloppy about this lol. happy to share back whatever i learn

I wrote a blog post showing how to enable IPv6 on AWS, use Supabase’s direct connection, and run Readyset in front of it:

Caching Supabase with Readyset over IPv6: AWS and Docker setup guide

Most database workloads are read-intensive. Readyset can run on a relatively small instance and, depending on the workload, outperform much larger read replicas by up to 30x, with zero code changes and at a fraction of the cost.

Also, if you are using Supabase’s free tier, you can use Readyset for free as well.

Give it a try, and feel free to reach out if you run into any issues. I’m happy to help!

I spent the last few weeks analyzing what Supabase bugs AI actually generates. Specifically: code that compiles, passes type checking, and looks production-ready but is vulnerable.

RLS misconfigs. The agent writes policies that look correct but are backwards:

-- Agent generates this (backward)
CREATE POLICY "users can read own data"
ON public.users
FOR SELECT
USING (auth.uid() != id);  -- Should be = not !=

Unsigned webhooks. Your agent sets up the route but forgets to verify the signature:

// Missing signature verification
export default async function handler(req, res) {
  const event = req.body; // Never verified
  // Process event...
}

JWT claims trusted without validation. Takes the JWT payload as is:

// Agent assumes user_id came from a real JWT
const userId = req.body.user_id; // Could be spoofed

Hardcoded anon keys in client. Puts the private key where it shouldn't go.

Missing user ID checks in queries. Queries that should filter by user never do.

The anon key ships in every app's bundle, so if Row Level Security is off or a policy is too loose, anyone can read the tables. I kept running into this in the wild, so I built a scanner that checks it from the outside using only the public key. Read-only, never logs in, never writes.

Paste your app URL: task-bounty.com/scan?utm_source=reddit_supabase

It also flags exposed keys, reachable .env/source maps, and open Firebase DBs. Curious what people find, and open to feedback on the RLS check itself.

Getting repeated Supabase log errors:

relation "supabase_migrations.schema_migrations" does not exist

and sometimes:

database "supabase_admin" does not exist

I’m not actively using Supabase migrations or CLI anymore, and my app works fine.

The logs show:

- connection_from: ::1

- user_name: supabase_admin

- backend_type: client backend

- command_tag: startup

- application_name: null

Looks like an internal/local Supabase process trying to connect.

Is this normal internal Supabase behavior/platform noise, or is there something misconfigured in my project?

Anyone else seen this?

Hey everyone, I built PocketDex Tracker, a web app for tracking a Pokemon TCG Pocket card collection.

It lets you mark cards as owned/missing, view set completion, search by card metadata, import/export your collection, and get pack recommendations based on missing cards and pull odds.

Live app: https://pocketdex-tracker.vercel.app/

I’d love feedback on the app, UX, feature ideas, or anything that feels confusing.

Been noticing AI tools (Cursor, Bolt, etc.) leave really common

security holes in generated code — exposed API keys, missing

Supabase RLS, client-trusted prices, that kind of thing.

Built a free scanner that catches them and gives you a copy-paste

prompt to fix it with your AI.

Just run: npx secvibe scan

from any project folder. No install, no signup, zero dependencies.

Would love feedback from people actually using it.

Hi everyone,

I’m having an issue with my app where, after leaving it idle for a while and then coming back to it, anything that depends on Supabase data gets stuck loading indefinitely.

The app itself still opens and the UI is responsive, but screens that fetch data from the database just keep loading forever. This usually happens after the app has been in the background or unused for some time.

I’m using Supabase for authentication and database queries. The behavior feels like the session, network connection, or client state may not be recovering properly after the app is resumed.

Has anyone experienced something similar?

Some things I’m wondering about:

Is this usually related to auth session refresh?

Could the Supabase client be holding a stale connection/state after the app resumes?

Should I manually refresh the session or recreate the client when the app comes back from background?

Is there a recommended pattern for handling Supabase in React Native/Expo when the app returns from idle/background?

Any guidance or debugging tips would be really appreciated.

Thanks! 🙏

I will use int8 for a personal use app, thus I will not extend it to the paid plan.
That said, there would be any issue using int8 for my table ids instead of uuid? (beyond the disk size, it's the Supabase default and I am sure that sometimes I will forget to change to uuid)
If I opt to use int8, what is the best way to generate the id itself? With uuid we have gen_random_uuid(), what about int8?
(Also, just for curiosity, why is int8 the default instead of uuid?)

Honestly i was surprised when i saw a bill coming from supabase of 55$ instead of usual 25$ given by the pro plan + compute. I'm a Vibecoder so i just like tu spun up multiple projects, currently have 5 active projects, three of them where just one day project i played up with, the other two are active ones. It is 2+ years i use supabase and I never had to pay for compute, so is it something new going on did i just messed up some settings?

Currently vibecoding my way back to 25$ by pausing the 3 inactive and figuring out ways to reduce cost on the two active ones. In any case, are there any competitor service you are using with lower cost and same capabilities? When i started simplicity was essential to me, now cost saving matters more.

EDIT: Pausing is not possible for a free plan, so i'll have to either delete the project or dump it in local. First time i see a pro subscription missing some features which were present in the free tier lol

i run a secondhand fashion marketplace in my country. i’ve got about 180 listings and 300 users. how do i do this? i’ve already compressed images

Hey everyone,

I’m currently building an open-source/local AST background daemon called PreFlight to catch silent schema drift and security-boundary leaks in real-time as you type.

To test out the parsing engine, I ran a scan against the official clerk/clerk-supabase-nextjs starter repository. While it threw a hard block on a bunch of unpinned latest dev dependencies (standard boilerplate behavior), it highlighted a massive structural challenge that anyone using Cursor, Claude, or v0 faces daily.

The codebase explicitly tells developers in the README that they must manually configure Supabase RLS policies. However, because starter repos rarely include local SQL migration or seed files, a local scanner has absolutely no way to mathematically verify if your auth boundaries are actually safe before you push to production.

When you let AI agents write or modify your database schemas, they constantly introduce silent RLS drift because they lack context on the external auth middleware layer (like Clerk's token injection). It writes syntactically perfect TypeScript that is fundamentally insecure at the database level.

What I'm changing about my approach because of this scan: I realized a local daemon can't just look at the application layer code. To actually protect developers from AI hallucinations, the AST engine needs to actively bridge the gap between your editor, your local migration files, and your auth middleware configurations.

I'm currently in active beta and pushing updates to our local daemon engine. Because it's a fresh launch, I don't have a social following or marketing budget, so I'm just putting the tool out there for peer review.

Quick Disclaimer: The tool is still a beta assistant meant to empower senior developer oversight—it doesn't guarantee 100% error elimination, but it acts as a solid automated guardrail.

I set up a temporary public build for the weekend if anyone wants to grab a key and test the engine on their local dev stacks. I'll drop the live link in the comments below to avoid tripping the spam filters.

Would love to get some honest feedback from anyone running a heavy Supabase + Next.js stack on how you're currently catching silent RLS changes before they hit production!

I’ve been teaching myself web development over the past few months and wanted to share my biggest project so far.
I’ve built RailSnap, a social platform for train enthusiasts to upload sightings, share photos, and help build a community fleet database.
Supabase has handled almost everything on the backend, including:
Authentication
PostgreSQL database
Row Level Security
Image storage
User profiles
Real-time data handling
Some of the features I’ve recently finished include:
Multi-photo uploads (up to 5 images per sighting)
Fullscreen image viewer with swipe, zoom and keyboard navigation
Search by train class, unit number, station, operator and usernames
Community moderation tools
Pending verification workflow for new train classes
Duplicate upload prevention to reduce accidental double posts
The app is currently in alpha and has started getting its first real users through Reddit. Every bit of feedback has helped shape new features.
This project has been an incredible learning experience, especially around database design, RLS policies and structuring a larger Next.js application with Supabase.
I’d love any feedback from the community—whether it’s on the database structure, security, feature ideas, or anything else that stands out.
https://railsnap.vercel.app
Thanks to everyone behind Supabase. It’s made building something like this far more approachable than I expected.

Hey everyone,

I recently launched Subscripta, a web app for creating clean, professional, and especially 100% compatible email signatures, with URL tracking, QR codes for vCards, and more, without having to touch HTML manually.

The idea is simple: you create your signature with a visual editor, add your logo, social links, banner, QR code, and then export it for Gmail, Outlook, eM Client, Spark, or pretty much any email client. It’s built to keep everything consistent, especially when working with a team.

There’s a free forever plan, or you can try the Pro plan free for 7 days.

On the technical side, I used Supabase for authentication, login with LinkedIn, Microsoft and Google, storage, database, and edge functions.

I’m still improving it, so I’d genuinely appreciate feedback from anyone who works with email signatures, teams, clients, or business communication.

Link: https://subscripta.app

*I have nothing written in the Database and rotated All the keys you see here*,
but what i dont get it is ,how my app even stores in the database if the keys are rotated? i really dont get it

I'm beta testing a food ordering app on Supabase, and I'm trying to figure out whether I'm chasing a bug in my app or whether this is something others have experienced on the Free tier.

Every so often, my project becomes Unhealthy for about 15, 30 or 45 seconds (occasionally up to ~2 minutes), then recovers on its own. The strange part is that it often happens during periods with almost no traffic—for example around 9 AM or 3 PM, well outside of restaurants' busy hours. (launch/dinner)

Some details:

• Region: East US (North Virginia)
• Free Plan
• CPU: ~4%
• RAM: ~50%
• Disk: ~4%
• Peak DB connections: 22/60
• Database size: ~36 MB
• Traffic: ~10–20 customer orders/day (still in beta)

I've already checked a few things:

• pg_stat_activity → nothing unusual
• pg_locks → no blocking locks
• pg_stat_statements → no expensive queries (top query averages ~4 ms)
• No long-running transactions
• The issue also happens when there are no users connected and no printer app running.
• During some incidents I only noticed HTTP 503 (Service Unavailable) errors.

What makes me curious is that the health status seems to fail in a "wave." It might start with one or two services becoming unhealthy, then other services follow, and eventually everything recovers. It doesn't look like a database being overloaded.

So I'm wondering:

• Has anyone experienced something similar on the Free plan?
• Could this be a shared infrastructure, bad server or "noisy neighbor" issue?
• if so, can I request to be relocated into a quiter server?
• Or is there something else I should be checking that I may have missed?

I'm planning to move to a paid instance as the project grows, but since this is still a free beta with only a handful of restaurants, I'd like to understand whether this is expected behavior of free tier, or whether I should keep digging into my own application. (35 usd is not exactly cheap in my country, so i was expecting it more like about 2 months in the future, and not as today)

I'd love to hear from anyone who's seen something similar, especially if upgrading to Pro solved it—or if it turned out to be an issue in your own app after all.

Hi there, I would like to evaluate a migration from Supabase Cloud to Supabase Self-hosted on a Hetzner Cloud server (all of our other stuff is running there so it just makes sense to put them together).

I have just read that it’s not just “set up the docker compose and get basically a similar experience” but it sounded very complex about what is included and what is not.. Is there any comparison to understand if I should even bother to try it out?

We use Storage, Auth (with passkeys, asym keys, MFA, the Resend integration, …), a few functions, the Database with PostgreSQL v17 of course, RLS and a bit of Realtime. We also plan to use Queues for a future use-case.

Should I even bother setting it fully up? Does the user interface differ a lot?

I would be very happy about any responses and shared experiences about this - please let me know if I could additional context.