Supabase Production Hardening series

Mar 6, 2026 ·8 min read · supabase , supabase-auth , postgres

Supabase Auth gives you auth.users for free. Roles need a second table, a trigger, and atomic deployment. Here's how the gap breaks production.

Mar 20, 2026 ·7 min read · supabase , postgrest , postgres

PostgREST's `.upsert({ onConflict: 'name' })` resolves against your real constraint name. Rename the constraint and the upsert silently fails.

Mar 27, 2026 ·7 min read · postgres , supabase , postgres-triggers

Step-by-step: build an audit log table, attach a SECURITY DEFINER trigger that captures every UPDATE and DELETE, lock it down with RLS.

Apr 3, 2026 ·7 min read · security , supabase , edge-functions

Edge functions that trust the Origin header for redirect URLs are open-redirect vulnerable. Here's the allowlist pattern that closes the gap.

Apr 10, 2026 ·7 min read · security , supabase , auth-jwt

Most forgot-password endpoints leak whether an email exists. The fix is one rule: return the same response always, regardless of account status.

Apr 17, 2026 ·8 min read · supabase , supabase-realtime , security

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag is the fix; here is when to use it.

Supabase Production Hardening series posts