Supabase Production Hardening series

Mar 6, 2026 ·7 min read · supabase , supabase-auth , postgres

auth.users gives you identity for free. Roles need a second table, a trigger, and an atomic migration. Here's where the gap breaks production.

Mar 20, 2026 ·6 min read · supabase , postgrest , postgres

PostgREST resolves onConflict against real constraint names at runtime. Rename a constraint and the upsert silently fails with a 400 nobody notices.

Mar 27, 2026 ·8 min read · postgres , supabase , postgres-triggers

Build an audit log table, attach a SECURITY DEFINER trigger that captures every UPDATE and DELETE, lock it down with RLS. Forty lines of SQL.

Apr 3, 2026 ·7 min read · security , supabase , edge-functions

Edge functions that trust the Origin or Referer header for redirect URLs are open-redirect vulnerable. One allowlist helper closes the gap.

Apr 10, 2026 ·6 min read · security , supabase , auth-jwt

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

Apr 17, 2026 ·7 min read · supabase , supabase-realtime , security

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

Jun 26, 2026 ·7 min read · supabase , supabase-vault , postgres

Use Supabase Vault to encrypt API keys and client secrets, keep metadata in Postgres, and gate decrypts behind one checked SECURITY DEFINER function.

Supabase Production Hardening series posts