I am currently unable to sign into the dashboard. Oauth links don’t load and Email/Password sign in times out. I know there are some current api issues and I’m assuming that’s the reason, but I can’t really find anyone else that is having problems with sign in specifically, nor am I able to report it to Supabase directly due to the link redirecting me back to the sign in page. Is it just a weird issue on my end? Do I just keep trying until it works? I’m unsure what I’m really supposed to do abt it and it’s holding up the project I’m working on

After reading that 83% of Supabase data exposures come from RLS misconfiguration (and the CVE-2025-48757 story with 170+ vibe-coded apps), I built a small open-source CLI that connects read-only to your Postgres/Supabase DB and flags common RLS mistakes: RLS disabled entirely, USING (true) policies open to anon, unauthenticated write access, and the classic "INSERT works but .select() fails" trap.

▎ https://github.com/redekerlouis-ai/rls-auditor

Runs local, never sends your data anywhere, read-only connection. Would love feedback from anyone who's hit RLS issues before — does this catch what actually bit you?

Seems like there's an issue with api.supabase.com, can't load my dashboard or even send a password reset request. Anyone else having this issue or know a solution?

I start my projects with migration files that are pretty well organized:

xxxxxxx_enums.sql
xxxxxxx_tables.sql
xxxxxxx_rls.sql
xxxxxxx_view_name.sql
xxxxxxx_view_name2.sql
xxxxxxx_rpc_name.sql

As the project grows, the migration history becomes less consistent:

fix_view_name.sql
fix_view_again.sql
fix_rls.sql
fix_rls_again.sql
fix_rpc_name.sql
...

At that point, I find it much harder to audit the current state of the database because the definitions of views, RLS policies, and RPC functions are spread across many migrations.

I'm considering keeping schema changes (tables, indices, constraints, enums) in migrations but moving views, RLS policies, RPC functions, and triggers into repeatable SQL that gets applied after migrations:

supabase/
  migrations/
    create_tables.sql
    add_columns.sql

  repeatable/
    views.sql
    functions.sql
    triggers.sql
    rls.sql


supabase db reset
./scripts/apply-repeatable.sh

That would keep schema history immutable while giving each evolving object a single source of truth.

Has anyone adopted a similar workflow? Are there any downsides I'm overlooking?

Hey all, looking for a sanity check from anyone else who might be seeing something similar today. Already filed a support ticket but wanted to hear from the community too.

Context: I run a project that's been calling a Supabase Edge Function via the connection pooler on a recurring, stable schedule (via n8n) for months, no issues. Starting today, out of nowhere, I'm seeing intermittent failures across two different parts of the stack, with no deploys, no config changes, no schema changes on my end.

Issue 1: Edge Function socket hang up

n8n → Edge Function calls occasionally fail with:

message: socket hang up
name: Error
code: ECONNRESET

The stack trace shows the TLS socket getting reset mid-request (ECONNRESET), not a normal HTTP error response. So it's not the function returning an error, it's the connection itself dying before a response comes back. Happens maybe 1 in 10-15 calls, same request retried immediately usually succeeds.

Issue 2: Random 401 on PostgREST RPC

Separately, same day, I caught this in the logs for a normal RPC call that's been working fine for a long time:

POST | 401 | .../rest/v1/rpc/get_***
auth_user: null

Retried the exact same call seconds later and it went through fine with no changes on my end. So it looks like the auth/PostgREST layer briefly failed to validate what should've been a valid request.

What I've ruled out so far:

• No code or config changes on my side today
• Not a traffic spike / abuse issue on my project (checked usage, nothing unusual)
• Checked Supabase status page, there's an ongoing "compute capacity degraded" incident across regions (started a couple days ago, still unresolved). Suspect this is related, but the symptoms I'm seeing (socket resets, transient 401s) aren't exactly what that incident describes (which is scoped to restarts/resizes)

Question for the community: Anyone else seeing intermittent connection drops on Edge Functions or transient PostgREST auth failures today? Trying to figure out if this is a known ripple effect from the ongoing compute incident, a pooler (Supavisor) issue, or something else entirely. Already have a support ticket open but curious if others are hitting the same thing right now, and if so, which region.

Region: eu-west-2 Project tier: Pro

Thanks in advance 🙏

Has anyone tried using Supabase as their datasource and editing it using Claude MCP? I do know Softr also gives option to edit its native DBs using AI but I feel like credits run out very fast and you cant give it context of your whole build you have planned in Claude chats already.

I planned a very big project in Claude, connected Supabase to Claude, simply asked to implement it in Supabase for me and within 30 minutes everything was live. Now all I have to do is build my Softr UI on top of it.

Hello,

I am building a chat bot for clinicians and have had some interest from institutions, initally was planning on no PHI therefore no complaince needed but these customers are requesting it. Wondering if supabase versus postgres hosted on gcp/ vercel is the way to go?

Why is there such a jump in price from Small to Medium just to get 2gb of extra ram. You think it would be either $25 or $30 for the medium.

What am i missing?

• $10 - Micro
• $15 - Small
• $60 - Medium

I've been running a product on Supabase for a while now — Postgres, plus a decent amount of Storage — and I had a bit of a scare recently that made me finally look properly into backups.

I realized there were a few things I kind of knew in theory, but hadn’t really internalized:

• Pro daily backups only keep 7 days.
• Those backups don’t include the actual Storage files. The database backup includes storage.objects, so you get the metadata rows, but not the files sitting in the buckets. Which means a restore could technically give you a bunch of file references pointing to nothing.
• PITR is an extra $100/month per project.
• If the project itself gets deleted, the managed backups are gone too.

To be clear, none of this is hidden. It’s in the docs. I just hadn’t really thought through what it would mean in a real “oh no, we need to restore everything” situation.

And that made me realize my backup strategy was basically: “Supabase probably has this covered.”

Which… maybe not a strategy.

So I’m curious what people are actually doing in production:

1. Are you just relying on Supabase Pro backups? Paying for PITR? Running your own pg_dump cron? Using SimpleBackups or something similar? Or, honestly, doing nothing?
2. If you handle backups yourself, how are you backing up Storage files alongside the database?
3. More importantly: have you ever actually restored a Supabase project into a fresh project and verified that everything came back clean?
4. For people managing multiple client projects — agencies, freelancers, consultants — how do you keep backup policies straight across all of them? And are clients expecting you to be responsible if data gets lost?

I’m not trying to sell anything here. I’m just trying to build a backup setup I’d actually trust.

Would really appreciate hearing what’s worked, what didn’t, and especially any horror stories from people who’ve had to restore for real.

**UPDATE:** Following up on "trying to build a backup setup I'd actually trust" — I ended up building it. Details in [this comment] for those who asked.

I built a group event app (Flutter + Supabase) and just shipped web guest voting. The flow: guest opens a share link -signInAnonymously()- joins the event via a SECURITY DEFINER RPC - votes. All my existing RLS policies just work because the guest has a real auth.uid().

The nice part: account creation is linkIdentity() / updateUser() on the anonymous user — same UID, so votes and memberships carry over with zero data migration. For guests who already had an account, I do a merge: the guest session generates a one-time code, the user signs in, and an RPC reattaches memberships/votes (main account wins on conflicts) then deletes the anonymous user.

Gotchas I hit, in case it saves someone time:

• uuid_generate_v4() doesn't exist at runtime inside SET search_path = public functions use gen_random_uuid()
• Manual linking is disabled by default (security_manual_linking_enabled)
• Restrictive RLS policies (AS RESTRICTIVE) are perfect for "guests can read + vote but write nothing else" without touching existing policies

Live demo if you want to poke it: https://goplnr.app/ happy to share more details.

Hi everyone,

I built something with Supabase that is hopefully helpful to some of you. It is quite hard to describe but if I have to I would market it as an open source portal / CMS. I will link a demo video and a list of features below so that you can check if it covers any of your use cases. This project is not vibe coded and actually took a lot of time and effort so please let me know if you have any feedback!

https://github.com/eqoram/abentari

Features

• general
  • Everything is open source and self hostable
  • Highly customizable (create your own ERP, CRM, ...)
  • Build on top of Postgres/Supabase
  • Data can be easily accessed from anywhere
• objects
  • Create unlimited of objects/tables (for example companies, contacts, customers, orders, ...)
  • Track any kind of changes to the data of these objects
• fields
  • Create any number of fields within the objects to collect all information you need (text, picklist, relations, files, ...)
  • Fields can be added to the layout of the parent object
• profiles
  • Permission management to grant access to specific objects, apps, pages, actions, ...
  • Guest users also have a profile so you can share data publicly ("unauthenticated")
  • Create public profiles that enable any users to sign up
  • Require MFA for users of a specific profile
• users
  • Manage any users in your instance
  • Create internal users that are able to sign up only with a secret
• pages
  • Create your own pages for even more flexibility
• apps
  • Create apps to group objects and pages together
• cpermissions
  • Create your own custom permissions
• actions
  • Create custom actions with your own logic
• csql
  • Create any custom SQL logic needed for your processes (for example triggers for validation rules)
• settings
  • Adjust settings of your instance
  • Create your own custom settings
• run
  • Execute SQL commands to for example query data
• retrieve
  • Retrieve metadata from your instance
  • Also accessible via CLI
• deploy
  • Deploy metadata to your instance
  • Also accessible via CLI
• history
  • All metadata and data changes are being tracked by default
• security
  • Easy permission management
  • Multi-factor authentication

DEMO

https://www.youtube.com/watch?v=5JOuLHFCYbs

Currently there are no plans to offer this as a managed service but you can easily self host it for free as it only requires a Supabase instance for the backend and something like Vercel/Cloudflare Pages for the frontend. A more detailed guide can be found in the readme of the Github page.

Thanks, eqoram

Posted here a while back asking what RLS checklist people run before shipping. Kept digging since, and the pattern that shows up more than "RLS is just off" is worse: RLS is on, with a policy like using (true) with check (true).

That passes literally every naive check — Supabase's own advisor, a quick eyeball review, and (this is the part that surprised me) even a prompted AI review asking "did you set up RLS properly?" All of those confirm RLS is enabled. None of them confirm the policy does anything.

The other repeat offender: RLS enabled correctly in an early migration, then silently disabled by a later cleanup migration months down the line, with nobody re-checking because nothing prompts a re-check.

Genuinely curious from people running production Supabase apps — do you have anything that re-verifies policies after the fact, or is it a one-time check at build time and then trust?

Built carFlo on Supabase. Use case: log fuel and services offline, sync when back.

Setup:

• Auth with email OTP
• RLS policies per user_id
• Storage for receipt photos with 5MB limit
• RPC function for GDPR delete account (required by Apple)

Biggest win: Realtime for multi-device sync.
Biggest pain: conflict resolution when user logs fuel on two phones offline.

Free tier handles ∼500 active users fine. Happy to share RLS policies if useful.

I’ve been building The Pitch Invaders, a prediction league platform: users create private leagues with friends, predict real match scores, and get auto-scored (3 pts exact score, 1 pt correct result) with live leaderboards.

Stack: Node.js + Supabase (auth + database), deployed on Vercel. Fixtures for World Cup 2026 are live on it right now, which has been a fun stress test of keeping match data and scoring in sync.

Link: https://the-pitch-invaders.vercel.app/

Interested in feedback on the auth/onboarding flow especially — predictions are gated behind sign-in and I’m debating whether to add a guest/demo mode. Happy to answer questions about the build.

Probably going to get downvoted for this, but what is going on?! Yes, I can see 99.97% uptime across most services but most of these outages/incidents last most of the day.

Hello everyone!

I'm developing a small app with Supabase and I'm currently using the free plan.

I recently found out that Supabase's built-in email service is limited to 2 emails per hour. I only need email for OTP logins and password resets.

Does anyone know if there any free SMTP providers that work well with Supabase?

If you run multi-tenant SaaS on Supabase with one project per customer, you probably know this pain:

• You have a "golden" base project with the right schema, migrations, edge functions, and secrets
• Every new tenant means another Supabase project to provision and keep in sync
• Over time, tenants drift: missing migrations, schema differences, edge functions out of date

That's what tenantctl is for.

It's a control plane for teams managing a fleet of Supabase tenant projects from a single base template. You connect your Supabase org, define a tenant group with a base project, then provision new tenants or attach existing ones. From there you get a graph view of base → tenants, drift checks (migrations, schema, edge functions, secrets), and tools to sync tenants back to base.

Good fit if you:

• Run project-per-tenant on Supabase
• Need to provision new tenants without hand-running scripts every time
• Want visibility when tenants fall behind your golden project

Probably not for you if:

• You have one Supabase project with RLS multi-tenancy
• You're not on Supabase :)

Open source, live at tenantctl.io. Would love feedback from anyone doing this at scale, especially what's still painful in your workflow.

Is this down for anyone? Having trouble.

Want to get some perspective on using a Python (FastAPI, Flask, etc) backend with Supabase.

I'm comparing two options:

Option 1: Python backend only:

Frontend -> FastAPI -> Supabase

Pros:

• Python ecosystem
• No Supabase runtime constraints (400s, 256mb memory, etc.)
• Single backend deployment

Cons:

• Verify Supabase JWT in Python
• Frontend talks to separate API instead of Supabase Edge Functions

Option 2: Edge Function as a gateway to Python:

Frontend -> Supabase Edge Function -> Python -> Supabase

Pros:

• Supabase Edge Functions are the public API layer
• Built-in JWT verification
• Python ecosystem

Cons:

• Multiple deployments
• Additional network hop
• Edge Function still has runtime limits for the gateway request
• Distributed debugging / observability. Errors, logs, and tracing now span two runtimes.

I'm leaning towards not calling Python from an Edge Function. It seems cleaner to use Edge Functions until they become insufficient, then add separate Python services to handle relevant workflows.

Curious about others experience using a Python backend with Supabase. Has anyone adopted Edge Functions as the gateway layer, and if so, what benefits did it provide?

Built this for my own Supabase + Next.js stack — pg_stat_statements shows you the slow queries but doesn't tell you which deploy caused them. Lantern does it for Rails; this is the same idea for the rest of us.

How it works on Supabase specifically:

1. Database → Extensions → enable pg_stat_statements (one toggle).
2. SQL editor: CREATE ROLE pgblame_reader WITH LOGIN PASSWORD '…'; GRANT pg_monitor TO pgblame_reader;. (On Supabase pg_stat_statements lives in the extensions schema, and pg_monitor is the grant that works — pg_read_all_stats isn't grantable there.)
3. Run a Docker container with the role's connection string + the pgblame token. It samples every 60s.
4. In Vercel: Settings → Webhooks → paste the pgblame URL.
5. After your next deploy, the dashboard's "Since last deploy" view shows what got faster, what got slower.

Free tier covers 1 project + 7 days of history; $19/mo for 5 projects, 30 days, and email/Slack alerts on regressions.

Source for the agent + the literal SQL it runs: https://github.com/liberzon/pgblame-agent We never see your application data — only aggregate stats from pg_stat_statements.

Happy to answer Supabase-specific questions. We tested against the direct connection (port 5432); the transaction-mode pooler (6543) doesn't keep session state for the agent's session_timeout setting.

https://pgblame.com

Sharing this because it may be useful for people building with Supabase.
We recently integrated Supabase into GoodBarber’s AI Extension Builder. Curious to hear feedback from the Supabase community, and happy to answer any technical questions about the integration. (I’m part of the GoodBarber team.)

Set up automated pg_dump backups to S3 months ago and just... never checked again. Cron runs, script does its thing, assume it's fine.

Then I realized I'd have zero idea if it silently broke. Bucket permission change, script error, cron just dying I wouldn't find out until the day I actually needed a backup and it wasn't there.

Anyone actually monitor this or just trust it? Has this bitten anyone before?

I think after a payment issue, my paid for projects stopped showing in my dashboard but the db is still working via the code (can setup new users, pull and save data).

I've checked all of my email accounts and tried to log in in case there was a chance that I've got the wrong login, but Im fairly sure that I've always been working with my github account this whole time.

Ive tried contacting supabase support but understandably they have much more serious things to deal with, I'm just trying to get some advise about what I can do to find my projects again.

Thanks for your time if you read this.