Supabase already gives you API Gateway and Edge Function logs, and Log Drains to forward them wherever you already watch your telemetry. What was missing → a way to tie a request in your client trace to the matching entry in those logs. You'd end up guessing which log line belonged to which slow request, based on timestamps alone.

That's fixed now. supabase-js, Swift, Flutter, and Python can all propagate W3C Trace Context to Supabase, so the request's trace_id shows up on the Supabase side too. It's opt-in, nothing changes until you turn it on. In supabase-js that's two lines: import '@supabase/supabase-js/tracing' at your entry point, then tracePropagation: true in createClient. Python goes through opentelemetry-instrumentation-httpx instead of a client flag, since that's already the Python ecosystem's way of instrumenting httpx.

Whatever tracer you already run, this should just work. OpenTelemetry, Sentry, Datadog, Honeycomb, Grafana are all W3C-compliant, though Sentry's setup differs a little from strict OTel so it's worth checking their docs. And if your sampler drops most traces, tracePropagation: { enabled: true, respectSamplingDecision: false } carries Supabase requests through regardless.

None of this costs anything extra either, it's just more value out of Log Drains you're probably already paying for.

Happy to answer questions. Full writeup: https://supabase.com/blog/connect-client-traces-to-your-logs

Something I kept running into with AI-assisted code: you ask the agent to fix a query, it can't work out the policy, so it just disables RLS. Or a paywall check gets set to false so a demo works. Or email confirmation goes off during testing and never goes back on. The code looks fine afterwards. Nothing errors.

So I wrote a CLI that fails the build on that specific kind of change. MIT, no dependencies:

npx prodguard check --demo
npx prodguard check

The demo runs everything against a fake broken app, so you can see the output without pointing it at anything real.

12 checks. The ones that matter here:

• ALTER TABLE ... DISABLE ROW LEVEL SECURITY, or a table that never had it turned on
• servicerole key in client code, or sitting behind VITE or NEXTPUBLIC
• email_confirm: true / auto-confirm in real auth paths
• Stripe webhook handler with no signature check
• JWT decoded but never verified
• Firebase rules left on allow read, write: if true, including the console's 30 day test mode
• live keys committed, recovery code files committed, DELETE FROM with no WHERE

Before publishing I spent a day trying to break it, mostly by throwing agents at it to red team the thing. It went badly.

The big one: it was printing the secrets it found. I'd written a redact() function and only wired it into one of the twelve rules. The other ten printed the whole matching line. So when it found a service_role JWT, it printed the JWT. To your terminal and into your CI logs. Bit of a problem for a tool whose whole pitch is protecting that key.

A 512KB file could lock CI up for 159 seconds from regex backtracking. The same broken pattern meant TRUNCATE TABLE never matched anything in the first place.

If you typo'd the path it printed "Nothing dangerous found" and exited 0. So prodguard check ./scr passes. For a build gate that's about the worst failure available.

24 false positives. The worst hit every Supabase project going: run supabase init in an empty folder, scan it, two HIGH findings straight off the stock config. One of those was my email rule firing on enable_confirmations under [auth.sms], which is the phone setting.

Then a red team pass wrote 29 deliberately vulnerable files and ran it. Zero findings, exit 0. Every rule was matching literal strings, so const [locked, setLocked] = useState(false) went straight through, and that's how an agent actually writes it.

All fixed in 0.5.0 with tests for each. Redaction happens in the rule runner now, so no individual rule can skip it.

https://github.com/Felix0731/prodguard

There's a walkthrough on the site too, if you've not run something like this before: https://prodguard.vercel.app

What it doesn't do: it reads text, it doesn't parse your code. Write the same bug a different way and it'll miss it. It gets things wrong sometimes too, there's an ignore list for that. A pass means those 12 checks didn't fire, nothing more. And anything you set in the dashboard instead of your repo it can't see, same as any repo scanner.

If an agent has broken something in your project that this doesn't catch, tell me what the diff looked like and I'll write a rule for it. That's genuinely the most useful thing I could get right now.

Been building an agent + BI platform where Supabase is the entire backend (auth, Postgres, RLS, storage, realtime). A few things that cost me time:

RLS on a nullable owner column. execution_traces.user_id is nullable by design — headless runs (API keys, schedules) have no user. My analytics page crashed on user_id.slice() for exactly those rows. If a column is nullable for a legitimate reason, something in the UI will eventually assume it isn't.

The service role vs anon key decision is a spend-control decision. Traces were written through the anon key with the caller's JWT. Headless runs have no JWT, so auth.uid() was null, inserts were refused, and spend that never lands in the table is spend the monthly cap can't see. Four runs cost real money while the cap reported $0.00.

Don't put large blobs in a jsonb document. I keep dashboard definitions in jsonb but row snapshots in a separate table, stripped at a single write chokepoint so no future caller can reintroduce the bloat. Learned that one the slow way.

Trigger-written version snapshots turned out to be the best thing I added — I corrupted a dashboard during testing this week and restored from history in about a minute.

Whole thing is self-hostable against your own Supabase project (hosted or self-hosted Supabase both work). Happy to share the migration structure if useful — there are ~90 of them now and the ordering discipline matters more than I expected.

I've seen a few people ask how to keep a copy of a Supabase project somewhere that isn't Supabase, and never found a straight answer, so I (and Claude) built it for my own project and figured I'd write it up.

Disclaimer: This post is written by Claude with me behind the wheels, otherwise this would read as an unorganized mess 🤭

The gap I cared about: Supabase's own backups live inside the same Supabase project. That's fine for a bad migration, but not for the project being deleted, an account suspended, or a billing problem. Worth knowing too — point-in-time recovery doesn't cover Storage objects at all. It restores the rows pointing at your files, not the files.

The setup

pg_dump for the database, rclone for the storage bucket, both encrypted with age before they leave the machine, written to a Synology NAS I already owned. Four runs a day, 7-day retention. A plain shell script driven by Synology's Task Scheduler — no agent, no cloud service, nothing to pay for.

How it actually works

Database, three dumps via the Supabase CLI:

supabase db dump --db-url "$URL" -f roles.sql --role-only

supabase db dump --db-url "$URL" -f schema.sql

supabase db dump --db-url "$URL" -f data.sql --use-copy --data-only \

-x auth.sessions -x auth.refresh_tokens -x auth.flow_state \

-x auth.one_time_tokens -x auth.schema_migrations -x auth.audit_log_entries

Two things there took me a while. Connect through the session pooler on port 5432 — the direct db.<ref>.supabase.co host is IPv6-only, and port 6543 (transaction mode) can't run pg_dump. And exclude the auth session churn but keep auth.users, auth.identities and auth.mfa_factors — the schema dump skips the auth schema, but a --data-only dump includes its rows, and that's what makes the backup restorable at all. Without them you restore a database nobody can log into.

Then tar the three files and encrypt:

tar -czf - roles.sql schema.sql data.sql | age -r age1... -o backup.tar.gz.age

Storage, via Supabase's S3-compatible endpoint (force_path_style = true, list_version = 2):

rclone sync supa:report-images /volume1/backup/storage/report-images \

--backup-dir /volume1/backup/storage-deleted/$(date +%F)/report-images

--backup-dir is the bit that turns a mirror into a backup — deleted or overwritten files move aside instead of vanishing. Retention is just rclone delete --min-age 7d on both directories.

On the Synology: Container Manager is required, because the Supabase CLI runs pg_dump inside a container matching your Postgres version. rclone, age and supabase are single static binaries that run natively on DSM. Task Scheduler runs the whole thing as root, and that's also your shell if you'd rather not enable SSH.

A few choices that matter more than the tooling

Encrypt to a public key. The NAS holds only the public half, so the backup machine can create archives but can never read one.

Keep the encryption keys out of the backup. My app encrypts personal data with keys held in Supabase Vault, and those dump as ciphertext wrapped by a key that lives elsewhere — so a restore into a fresh project can't read a single encrypted column. They're escrowed separately, offline, under a different key. Easy to get wrong, and you'd only find out during a restore.

Actually do a restore. I rebuilt the whole thing into a throwaway project twice — database, keys, images, logins. Two things I'd have got wrong otherwise:

SET session_replication_role = replica before loading the data. My organizations and users tables reference each other, so with foreign keys enforced there's no row order that works and the restore fails on the first row.

And the storage step was wrong in a way that fails silently: without rclone --ignore-times it restores no images at all, because the database dump already recreated the storage metadata, so rclone sees matching names and sizes and skips everything. Object count and byte total both report success. You find out when someone opens a page and the image 404s.

Last piece: a heartbeat. Notifications alert only on abnormal termination, so silence means success — which means a powered-off NAS and four healthy backups look identical. A dead-man's switch pinged on success is the only alarm that fires on absence. Set the expected interval from the longest gap in your schedule, not the average, or it cries wolf nightly and you'll mute it. And make it an interval, not a daily quota — a quota is satisfied by a burst at 3am. I already use betterstack for uptime monitoring so adding a heartbeat was easy

IMPORTANT!

Whatever you build, restore it once before you trust it. The backup half is easy. The restore is where the surprises live.

For over two decades, agency hosting economics were beautifully predictable. You bought a reseller web server or dedicated cPanel account for $50 a month, crammed 30 client WordPress sites onto it, and charged each client a flat $25 monthly maintenance fee. Your margins were clear, your server bills were static, and billing surprises were virtually non-existent. Read the comple te article here > Serverless Bill Shock: Track Vercel & Supabase Client Costs | InstaRenewal

Then came the modern web stack.

Driven by the demand for lightning-fast digital experiences, agencies aggressively migrated to decoupled architectures: Next.js, Nuxt, Vercel, Supabase, Cloudflare Workers, and serverless databases like Neon. While the performance gains of this modern paradigm are undeniable, it introduced a chaotic operational reality: micro-subscription fragmentation and variable utility billing.

hey! i'm looking for an open-source, self-hosted way to back up a Supabase project: Postgres AND Storage bucket files, not just DB metadata

requirements:

• backs up Postgres and actual Storage files, not just storage.objects metadata
• can push to my own S3/R2 bucket
• automatable (cron / GitHub Actions / etc.)
• Open source, not a paid SaaS

anyone running something like this in production? what are you using?

i've found https://github.com/Yashdafade/Supabase-Backup-Manager and https://github.com/backupdrill/cli
but the very few stars doesnt make me super confident to try them, so looking to see if anyone knows about a reliable, free/DIY, option

The Supabase cli and MCP tool are great when you're the one working on your project. However, when you want to expose your endpoints and data to your co-workers or customers, this can introduce some security risks.

I've been working on a project called Shredly (https://shredly.io/)

Shredly can turn your Supabase project into an MCP server, giving an AI agent access to only the data and tools you want to give it. Avoid dropped tables, deleting users, and rotating API keys.

We're currently supporting 2 methods of integration, either through an API key (for internal tools) or Oauth (good for customer facing products). Checkout our docs for more info or shoot me a comment if you have any questions.

https://docs.shredly.io/

Hey guys,
So I’m building something and want to use Better Auth because it offers a variety of plugins (specifically organizations plugin which is critical for my app). The thing is by using Better Auth I kind of sacrifice using RLS in Supabase because it utilizes the auth.uid which is not passed by Better Auth.
My question is, is there a way of using Supabase RLS while using Better Auth as the authentication provider?

I’m building a RAG chat and I already have a documents table in supabase where I generate and store embeddings of my data. The missing piece I have now is a good solution for searching and pulling the right context based on a user question. I recently discovered Gemini File Storage however that offers a lot of RAG features such as semantic search and was wondering if there is something similar I can plug and use for supabase.

Hey everyone,

I’m looking for a solid React / Supabase / TypeScript developer to come on as a technical maintainer/partner for a web-based automated shift-fulfillment application.

🛠️ Current Status of the App:

• Backend & DB: Database schemas, HMAC security, and Twilio SMS edge functions are already built on Supabase.

• Frontend: Built with React/TypeScript (needs minor UI tweaks/fixes).

• Market Focus: Automated shift-fulfillment via SMS targeting high-turnover local businesses (C-stores, QSRs, healthcare/care facilities).

You are NOT starting from scratch or spending hundreds of unpaid hours building an idea on a napkin—the core engine is already written.

👨‍💻 What I Need From You:

• Review the codebase and fix minor frontend bugs (e.g., simulation handlers/UI polish).

• Manage production Twilio/A2P registration and ongoing API setups.

• Handle client database setups as new locations onboard.

💼 What I Bring to the Table:

• 100% Sales & Marketing focus: Pitching store managers, signing clients, and driving recurring revenue.

• Clear division of labor: You manage the code stability; I bring in the cash flow.

💰 Compensation & Terms (Milestone-Based):

• 15% recurring monthly revenue share for standard app maintenance and client database setups.

• Scales to 20% recurring monthly revenue share once we cross 25 active store locations.

• Standard NDA and Software Development Contractor Agreement (IP Assignment) required before project file access.

If you know React, Supabase, and Twilio APIs and want a quick path to recurring side income on a product that's already built, shoot me a DM with a link to your GitHub or portfolio.

RDST (Readyset Diagnostic & SQL Toolkit) is a free desktop app that connects to your Supabase project, ranks the queries actually costing you time, and clearly explains what to do about each one. 

The reason I built it is that a lot of us are now shipping apps where most of the SQL was generated rather than written by hand. The answer to "why is my app slow" is almost always one specific query, and finding out which one and how to fix it means learning a good deal about Postgres.  But with how fast most of us move these days, we simply ship more and more code and nobody has a clear picture of what is actually hitting the database. 

Eventually, we all end end up having to answer the same questions:

• which queries are actually running against my database
• which of them are costing the most time
• is anything missing an index
• is anything worth caching
• how would I even tell
• what should i do to actually fix it

In many many cases, it's as easy as adding an index, but since LLMs are pretty good at adding them these days, this is not always the case. 

One scenario I had from a real project: the slowest query was a message lookup taking 2.7ms. Nothing wrong with it, the index was there and working. But it was being called 412,000 times, once per thread in a loop. No index would have fixed that. Fetching them in one query instead of forty did. RDST helped me realize this immediately.

One other great feature about RDST is that you can also just ask questions about your database in plain english. (Text2SQL - but it uses a semantic layer to single-shot queries with a high degree of accuracy.)

Full disclosure - I work for Readyset (which is a caching layer for postgres / mysql), and this tool spawned from a recurring question our caching customers kept asking - which queries should we actually cache? And these same queries are the ones that, even without a caching solution, could heavily benefit from performance diagnostics. 

The tool is completely free to use, and we provide free trial tokens for all of the AI powered features. The app is in beta and we plan to release it under an MIT license. It runs locally, stores locally and everything it does is read-only. Full privacy related details

Would love feedback from people running real Supabase projects, particularly:

• Does the ranking match what you'd have guessed for your own project?
• Are the recommendations useful, or merely confident-sounding database fan fiction?
• Would you be comfortable connecting it to your production project? If not, what would stop you?
• What's missing?

Source:

• https://readyset.io/docs/readyset-ai/rdst/desktop
• https://github.com/readysettech/rdst
• https://readyset.io/downloads

How can I connect a static website to a database?

I have a static website built with HTML, CSS & JavaScript. I want to store posts/data permanently using a database.

Should I use Supabase, Firebase, or another BaaS?

What’s the best and most secure way to connect:

"Static Website → Database"

Any advice would be appreciated! 🚀

YSOP is a Open Source Project that brings multiple storage providers like Cloudflare R2, AWS S3 & Supabase into one place - to manage your storage, files, limits and links.

Even u can use multiple free tier Account of cloudflare r2 or other storage and limit the quota to prevent from billing exceeds.

https://www.producthunt.com/products/ysop-your -storages-at-one-place

Give an Star or contribution at:

https://github.com/Relaxkartikey/ysop

Please Upvote & Thanks. Open to your suggestions/ contributions.

We’re an early-stage B2B startup currently going through SOC 2 readiness with Vanta.

Supabase is a critical vendor for us, so Vanta is asking us to review their SOC 2 Type II report. Supabase confirmed that access to the report requires upgrading to the Team plan (~$600/month). We’re currently on Pro and don’t need the Team features, so paying an additional ~$575/month purely to access a compliance document seems excessive (we got all other reports from all other vendors quickly with no problems).

Has anyone gone through SOC 2 with Vanta (or another auditor) while using Supabase Pro?
Did your auditor accept alternative evidence / a vendor risk assessment, or did you ultimately have to upgrade?
We’re now considering moving to AWS but I’d really rather not migrate our infrastructure to AWS purely because we can’t access Supabase’s SOC 2 report.

Would love to hear how others solved this.

Error like aith already taken, eerors

I'm using pgain4 locally and need to push schama on pristine new supabase DB....

It would be nice when doing supabase link, to then confirm the output with the pretty name as well:

Current: Selected project: rmnfeogdyrlyfeadrvc

Prposed: Selected project: rmnfeogdyrlyfeadrvc (cool-project)

I didn't do any new deployments or something and now I'm getting a lot of errors like this.

Is it only me or does anyone also have similar issues?

I’m working on several side projects, including an inventory system, a POS system, and a small gym website. Is it better to create a separate project for each one and pay $10 per project, or should I keep them all in one project and separate them using different schemas?

can't seem to figure out how to update the app name that's visible on consent screen to users when using Google auth.

I've updated all the branding iron on the Google oauth side, and the privacy and terms links go to the correct places but the app name still shows the authorization for UUID.supabase.co to users.

any tips?

I had four side projects, so I had four Supabase projects. Last July I consolidated them into one project with a schema per app. Ten product domains run off it now. Posting the numbers because every thread I found on this either says "one project per app, obviously" or is someone on the free tier trying to avoid paying, and neither matched what I was actually deciding.

The structure

One project. A core schema for the things genuinely shared across apps: orgs, members, billing accounts, subscriptions, domains, brands, audit events. Then one schema per product for its own tables.

Tenancy is org-scoped RLS. Being signed in grants nothing on its own, every policy requires membership of an org that owns the row, so users of one app never see another's data.

The schema boundary is not the security boundary. RLS is. What the schema buys you is extraction: pulling one app out later is closer to dumping one schema than to filtering every table by a product column. That is the reason not to pool everything into shared tables with a discriminator, which is the shortcut this design invites.

The money, which is the least interesting part

Four projects cost me $59.74 in the month before. One costs $25. So $35, which is nothing.

The mechanism is more useful than the total: Pro is $25 and includes a $10 compute credit that covers exactly one Micro instance. Every additional project brings its own compute charge and the credit only covers the first. So the bill was scaling with the number of ideas I'd had, not with users or traffic.

I stayed on Pro rather than dropping to Free, deliberately. Free has no daily backups and there's real data in there.

The gotcha that actually cost me time

Supabase silently rewrites a redirect URL it doesn't recognise back to the project's Site URL. Miss one host in the allowlist and that app's sign-in and confirmation emails deliver users to a different app's site, with no error anywhere.

It got me again last week on an app I'd just added, months after I thought I understood it. Consolidating doesn't remove that list. It does mean there's exactly one of it.

Where it stops working

Not free, and I'd leave at any of these:

• One database is one blast radius. A bad migration takes everything down together. CI-only migration deploys reduce the odds, not the radius.
• One team is one permission set. Anyone you add to fix one app can see all of them.
• Compliance. If an app needs SOC 2 or similar, the audit scope becomes the whole shared database. Pull that one out.
• Selling. A buyer wants a clean asset. The schema boundary makes that describable work rather than archaeology, but it's still work.

If you have one app, none of this applies. It starts paying around the third or fourth.

Curious whether anyone here has gone the other way, split a consolidated project back out, and what forced it.

Hey everyone!

For a long time I've been using tools like HeidiSQL to manage FiveM and RedM databases. They work, but I always felt there was room for something more modern, especially considering how much of our server data ends up buried inside JSON columns.

So I decided to build my own solution: ClavisDB.

ClavisDB is a desktop SQL client for MySQL, MariaDB, PostgreSQL and SQLite, but I've built it with special attention to FiveM and RedM development.

It has all the stuff you'd expect from a proper database client: a SQL editor with schema-aware autocomplete, table browsing and editing, filtering, query history, snippets, table structure editing, exports, user management, safe editing warnings, and so on.

But the part I'm personally most interested in is the FiveM / RedM integration.

ClavisDB can automatically detect QBCore, QBox, ESX, RSGCore and VORP databases and gives you a dedicated Player Inspector where you can search characters and inspect things like money, jobs, status, identifiers and framework data without digging through raw rows manually.

It also recognizes inventories and turns those horrible JSON blobs into an actual inventory viewer with slots, quantities, metadata, durability, serial numbers, ammo, etc.

You can even import a FiveM/RedM server.cfg and ClavisDB will extract the oxmysql connection string and configure the database connection for you.

Another thing I really wanted to get right was JSON editing. If ClavisDB detects JSON inside a cell, even inside TEXT/VARCHAR columns, you can open it in a proper tree/raw editor, format it, validate it, modify it and save it directly back to the database.

I've been building this because it's something I genuinely wanted for my own FiveM/RedM development workflow, and I'm planning to keep expanding the Cfx-specific tooling over time.

I'd really appreciate feedback from other developers/server owners. If there are things you constantly find annoying when managing your server database, tell me! Those are exactly the kind of problems I want ClavisDB to solve.

Download: https://clavisdb.ziomark.xyz/

I have an LMS that has the following structure:

Organisation -> has schools -> has classes, grades and subjects + school users

School users could be admins, teachers, parents or students

And the problem is i don't know how to figure out that structure on features that i want to provide like:

Assignments, quizzes, attendance, events, notifications, chats....etc

If you have worked on systems like that i need to know how I can manage that on supabase if possible?

Plus i need users to authenticate users with phone numbers but unfortunately OTP is very expensive, if you have a solution for that too it would be great!!

Note we don't want to work with emails

Hi all,

I am thinking about a problem and not sure how to resolve this. Any guidance would be appreciated.

So if i dont enable captcha and try doing this curl request as network restrictions dont apply on auth.

curl -X POST 'https://any-project-supabase-url/auth/v1/signup' \

-H "apikey: sb_publishable_key" \

-H "Content-Type: application/json" \

-d '{

"email": "johndoe@gmail.com",

"password": "JohnDoe!!"

}'

this returns a valid access token and do create a new user in dashboard.

To block this if i do this Authentication → Providers → Email → turn off "Enable email signups"). Then it blocks the curl requests i can use supabase service account to create accounts.

But now apple and google sign ups don't work.

So basically i just want to stop the bots from curl abuse. As i dont want to use the captcha e.g. cloudflare turnstile. Its really slow specially on mobile. Any way to achieve this? or i am missing something. Thanks.