Skip to content
unnudged
Get early access
brandNo recent capture

Supabase on X

Supabase draws far more praise than complaint: 98 people call it easy, cheap or the obvious place to build. Behind that, 14 report leaked or wiped data from open permissions and keys, and others weigh cheaper hosts or ask what it costs.

First written 27 Oct · what changed · from 296 posts by 261 people

Tracking posts that say “supabase”

Track this for your market
Posts, last 24h
—
Last captured 34h ago
Posts, last 7 days
387
106 in the last 72h
Velocity
55/day
7-day average
Momentum
—
Needs a recent capture to measure

Posts per day, last 30 days

as of Nov 3, 10:00 UTC
2001000Oct 20: 1 postsOct 20Oct 21: 42 postsOct 22: 57 postsOct 23: 43 postsOct 24: 105 postsOct 25: 26 postsOct 26: 81 postsOct 26Oct 27: 87 postsOct 28: 67 postsOct 29: 39 postsOct 30: 88 postsOct 31: 43 postsNov 1: 61 postsNov 2: 2 postsNov 2

What changed

as of 27 Oct · checked once a month

First written 27 Oct. When what people say changes, it shows here.

Tone· 168 posts from 151 people· written 27 Oct

How do people feel about Supabase?

Praise carries this section: 98 people call Supabase easy, cheap or the obvious place to start, and 31 more recommend it by name when someone asks what to build on. A smaller strand, 12 people, rates it fine for an MVP but expects to migrate or self-host later, and 11 are skeptical of it outright.

Praise comes in two shapes. Some describe Supabase as part of a stack that costs almost nothing — database, login and storage behind a Vercel or Cloudflare front end, with one person saying it gives "a real head start" while vibe coding. Others credit new machinery: the MCP server, which one user says makes configuration much easier, and Compute, where one team reports answers 1.7x faster at 4.7x lower model cost. 31 people recommend it in a single word, often "supabase" alone in reply to a what-should-I-use question.

The doubters are fewer. 11 call it overkill, ask "why even use supabase?" over plain Postgres, or say they would take almost any other Postgres host. 12 take the middle line: good to start, likely to migrate or self-host later, with one planning to move to Coolify once the app launches.

  • Praises it108
  • Recommends it to others36
  • Good to start, outgrown later13
  • Skeptical or dismissive11
See 5 of 168 posts
テクノビビ / 個人開発@techno_bibi

もう個人開発はWebアプリもモバイルアプリもCloudflare + Supabaseで十分じゃない？ サーバーやDBの運用が不要で、認証基盤まで揃ってる。しかも無料枠がかなり充実している。 この認証基盤で突破されたら君の実装でも突破されてる

5 of the 168 posts behind this answer, one per person. The other 163, and every new one as it’s posted, come with tracking. Get early access

Pain points· 74 posts from 68 people· written 27 Oct

What do people complain about with Supabase?

Security is the most-reported problem: 14 people describe apps leaking or losing data when Row Level Security, views or keys are left open, including one app whose user profiles were wiped. Cost and the Deno runtime follow level with each other, at 12 and 12 people.

The largest group is about what people find in apps built fast. A view that showed users each other's profiles bypassed RLS, and someone wiped 35k profiles through the public API before backups restored them; others warn that "supabase rules get skipped constantly" in vibe-coded apps and that RLS is off by default on tables created in SQL. Two posts describe the service role key left in a NEXT_PUBLIC_ variable, readable in every visitor's browser.

Cost complaints are about bills that surprise people — "your first oopsie bill", a minimum commitment, a paid trap after the free tier — and about paying for hosting they could self-host. On the runtime, 12 people puzzle over Deno's end and whether Edge Functions move off it.

Smaller grips: free projects that pause, deprecated anon keys and removed adapters forcing edits, a lost project in the dashboard, short outages and national blocks, broken perk emails, slow support and auth emails landing in spam.

  • Security and permissions gaps17
  • Costs add up14
  • Deno runtime uncertainty12
  • Free tier limits9
  • Forced API and key migrations5
  • Dashboard and setup friction5
See 5 of 74 posts
Momen Adel@MomenBuilds

my friend @MaxHirsch13 got hacked last night and all 35k user profiles on Maxed AI were deleted here’s what happened / how i helped fix it / how to prevent it: someone sent around 3,500 delete requests to his app and managed to wipe almost every user profile the first thing we focused on was getting everyone's data back, thankfully max was on Supabase Pro and had daily backups enabled, so we were able to recover the accounts but the real question was how someone managed to delete all those profiles in the first place after looking into the database permissions, we found the issue max had created a database view that allowed users to see each other's profiles, but that view was bypassing RLS (Row Level Security), which is supposed to control what data each user can access on top of that, the public anon role still had permissions that allowed deletion through the view basically, something that was supposed to let users VIEW other profiles accidentally gave the public a way to DELETE them and since Supabase's anon key is public by design, the attacker didn't need access to some private admin key to abuse it here's what i'd recommend checking in ur own app so this doesn't happen to u: 1. check ur RLS policies make sure every exposed table has RLS enabled and that users can only access or modify data they're actually allowed to, especially when it comes to DELETE and UPDATE operations 2. check every database view this was the main issue in max's case, make sure views use security_invoker = true where supported so they respect the underlying permissions, and check that public users can't write or delete through views they should only be reading 3. check ur API and database permissions just because someone is logged in doesn't mean they should be able to access everything, make sure every sensitive endpoint verifies the user and checks ownership before reading, editing, or deleting anything also check what the anon role can actually do in Supabase, a public API key should never give someone permission to delete private user data 4. check what happens when something gets deleted look for ON DELETE CASCADE rules because deleting one record can automatically delete other connected records also review privileged database functions and make sure users can't abuse them to bypass permissions 5. protect ur authentication and secrets make sure users can't change their own admin roles or subscription status, verify webhook signatures, remove any temporary authentication bypasses, and never expose private API keys in ur frontend 6. add protection against mass deletion limit dangerous operations where possible, keep logs of important actions, set up alerts for unusual activity, and make sure u have working backups even if someone finds a vulnerability, u don't want one request or a few thousand automated requests to permanently destroy ur entire database 7. actually test ur security create two test accounts and check whether one can access, edit, or delete the other's private data run Supabase Security Advisor and check the issues it reports and don't assume ur app is secure just because everything works normally tbh the scary part about this whole situation is that it wasn't some crazy complicated vulnerability, it came down to database permissions that were easy to overlook one mistake was enough to put 35k profiles at risk i've worked on security audits for different SaaS companies and one thing i've learned is that some of the most dangerous vulnerabilities come from the simplest mistakes so please spend some time checking ur app's security, especially if you're using AI agents to build most of ur code it takes way less time to check these things now than to recover an entire database after someone deletes it

Tacuns@rsg_rishi

Unpopular truth: Asking the same AI agent that wrote your code to "check for security bugs" is security theater. It will happily tell you your app is production-ready while shipping: • Tables without Row-Level Security • Client-submitted checkout prices • Parallel TOCTOU double-spend exploits • Exposed NEXT_PUBLIC_ keys • Dead href="#" UI buttons To actually secure vibe-coded apps, you have to pit agents against each other. That’s why I built and open-sourced Vibe Aegis v2.0 🛡️ It combines a zero-dependency Python 3.8+ scanner (static code + git forensics + live URL pre-flight) with a 10-Stage Adversarial Loop: Recon → 7 Specialist Hunters → Adversarial Skeptic → Evidence Referee → Guarded Auto-Fixer It audits everything from Supabase RLS, IDOR, and Stripe race conditions to LLM Denial-of-Wallet caps and 375px mobile overflow traps. Drop this into Claude Code, Cursor, or Windsurf to run it in 30 seconds: "Read link and execute the Vibe Aegis setup and 10-stage First-to-Last audit in this repository." Repo (MIT) in the reply below 👇

Aster@TheAsterCo

My admin page said "permission denied." My AI fixed it with the master key. It put the Supabase service role key in a NEXT_PUBLIC_ variable. Now it's in every visitor's browser. How to lock it back 🧵

Hitesh Choudhary@Hiteshdotcom

I am expecting changes in @supabase functions. They are working great for us but they are on Deno. With cloudflare news of acquiring Deno, I guess some big infra decisions are to be made at Supabase. Let’s wait for announcement.

Soraia@SoraiaDev

€130/mo → €13/mo stop paying for pretty ui and self host my stack: - resend (€80/mo) → aws ses + listmonk - supabase (€25/mo) → hetzner + postgresql - vercel (€25/mo) → hetzner + coolify - auth → better-auth (free) - storage → cloudflare r2 (zero egress) steal it if you want to cut down costs

5 of the 74 posts behind this answer, one per person. The other 69, and every new one as it’s posted, come with tracking. Get early access

Alternatives· 67 posts from 62 people· written 27 Oct

What are the alternatives to Supabase?

Three names come up level with each other: 9 people weigh Cloudflare, 9 weigh Neon and 9 weigh self-hosting or plain Postgres. Talk about all three turns on cost or control rather than on features.

Cloudflare is named two ways: paired with Supabase as a stack whose bill stays "close to zero", and as the place people move their projects to for "a fraction of the cost". Neon draws people switching for its free project allowance, with one saying Supabase gives you two projects against Neon's hundred, and one finding responses slow compared with Neon. Plain Postgres and self-hosting come up as an exit — Supabase is described as a layer over Postgres you can drop — though one who tried the open-source build went back to vanilla after it went badly.

Behind them, 5 name SQLite for small or local-first projects, and 4 describe moving to Coolify on a cheap VPS once the bill flinches, citing about $60 a month against $191 a year. Clerk (3), PlanetScale (3) and AWS (3) are each named by a few, as an auth choice or a migration target.

  • Cloudflare10
  • Neon9
  • Self-hosting or plain Postgres9
  • SQLite5
  • Coolify and cheap VPS5
  • Clerk3
See 5 of 67 posts
Max Winter-Leinweber@MaxWinterL

Object storage seems to be the first thing I have migrated when using Neon and Supabase. From Supabase to Neon to increase the limit of free projects. From Neon object storage to Cloudflare to dodge the low free tier limits. The goal is to be a cheapskate.

5 of the 67 posts behind this answer, one per person. The other 62, and every new one as it’s posted, come with tracking. Get early access

Questions· 34 posts· written 27 Oct

What do people ask about Supabase?

The two biggest questions are level: 7 people ask why use Supabase rather than plain Postgres or another backend, and 7 ask what it costs and what the free tier covers. Right behind them, also level, 6 ask whether Edge Functions will stay on Deno and 6 ask whether it is secure enough to ship.

The plain-Postgres questions are blunt — "why even use supabase?" — and one developer wonders whether ORMs on a database they run themselves is the better route. The cost questions mix plan maths with free-tier limits, from whether to use Notion as a free database to worry about a project topping out on database room before its auth user allowance. One reply puts the Pro subscription at a low monthly price.

The runtime question comes almost entirely from the news that Deno's future is in doubt: people ask whether Supabase moves its edge runtime to Node, and one says they would hold off putting core logic in edge functions until Compute. The security questions ask whether the MCP server runs each query as the signed-in user so RLS still applies, and whether the Security Advisor flagged the view behind a breach.

Smaller asks: how to migrate and set up branching, whether a runtime can be pinned, use in mainland China, and whether talks get recorded.

  • Why Supabase over plain Postgres?7
  • What does it cost, and what's free?7
  • Will Edge Functions leave Deno?6
  • Is it secure enough to ship?6
  • How do I set up and migrate?3
  • Does it support X?2
See 5 of 34 posts
Patrick Campanale@pcamp96

Were you using Supabase just as a database, or also as auth? I'm using Supabase for both auth and db, and I'm worried that I'm going to run out of db room far before auth room. Never thought about running the DB separate from auth before just typing it out though.

Hitesh Choudhary@Hiteshdotcom

I am expecting changes in @supabase functions. They are working great for us but they are on Deno. With cloudflare news of acquiring Deno, I guess some big infra decisions are to be made at Supabase. Let’s wait for announcement.

5 of the 34 posts behind this answer, one per person. The other 29, and every new one as it’s posted, come with tracking. Get early access

Wishes· 9 posts· written 27 Oct

What do people want from Supabase?

Wishes are small and scattered: 2 people want better Edge Functions, 2 want languages and runtimes beyond TypeScript and 2 want easier account switching, with single asks behind them.

The edge-function asks are about performance and runtime: one says raising edge function performance or allowing persistent background workers "would take all my money", and another would be delighted if the runtime moved to Node.js. The language asks are for support beyond the current set and for pinning a runtime version so a migration can be reproduced. On accounts, one developer juggling five Supabase accounts wants plugins and multi-account sign-in instead of five MCPs or constant switching, and another cannot work out which email holds an old project.

The rest are one person each: re-sending an auth invite after the link expires, starting on the managed service and later running it on-prem, a migration sample covering persisted auth sessions and realtime reconnects, and one wondering why the managed ETL to Iceberg was dropped.

  • Better Edge Functions2
  • More languages and runtimes2
  • Easier account switching2
  • Resend invites1
  • On-prem option1
  • Migration guide with real cases1
See 5 of 9 posts
Philip Fowdar@philfowdar

Started using T3 for the first time today. Not quite as polished and user friendly as Codex, but it's light, fast, and the best thing is the ability to manage multiple providers and multiple accounts all together! Can we get plugins and multi-account sign in? Eg I have 5 supabase accounts. 5 MCPs or switching constantly sucks. Thanks Theo for T3! You've got me won over!

5 of the 9 posts behind this answer, one per person. The other 4, and every new one as it’s posted, come with tracking. Get early access

In their words

How do people talk about Supabase?

The phrases people use most, counted once per person.

  1. 1“edge functions”10
  2. 2“mcp server”5
  3. 3“row level security”4
  4. 4“supabase auth”4
  5. 5“free tier”3
  6. 6“api keys”3
  7. 7“supabase to neon”2
  8. 8“grant to anon”2
  9. 9“vibe coded apps”2
  10. 10“enough to ship”2
  11. 11“self hosted”2

Posts are shown the way X shows them. One of them yours? Here’s why it’s shown, and how to take it off.

Also in Backend platforms

Get every post about Supabase, filtered and labelled

This page is the summary. Tracking gives you the stream behind it for any brand, keyword or @mention: each new pain point, request and question as it’s posted, with the spam and promotions already taken out.