The Supabase Production Hardening series.

$ series --progress

Posts: 8
Full arc: 88 min
Published: Mar→Jul 2026
You have read: 0 of 8

Progress is stored in this browser only. Nothing is sent anywhere.

Start at part 01

[02]The arc

[03]In publish order

Mar 6, 2026 7 min Part 01 of 08

Two-layer identity models in Supabase: when auth and authorization disagree

Supabase Auth creates identities, not roles. Use a user_roles table, RLS policies, and one trigger migration so signups never strand users without permissions.

Start here

Mar 20, 2026 6 min Part 02 of 08

How a Postgres constraint rename silently broke production via PostgREST

PostgREST resolves onConflict against real constraint names at runtime. Rename a constraint and the upsert silently fails with a 400 nobody notices.

Mar 27, 2026 8 min Part 03 of 08

How to build a tamper-evident audit log in Postgres with one trigger

Build an audit log table, attach a SECURITY DEFINER trigger that captures every UPDATE and DELETE, lock it down with RLS. Forty lines of SQL.

Apr 3, 2026 7 min Part 04 of 08

Origin validation in edge functions: the open redirect you ship by default

Edge functions that trust the Origin or Referer header for redirect URLs are open-redirect vulnerable. One allowlist helper closes the gap.

Apr 10, 2026 6 min Part 05 of 08

User enumeration via password reset: the bug in default forgot-password flows

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

Apr 17, 2026 7 min Part 06 of 08

Realtime broadcast scope is a security boundary, not a routing convenience

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

Jun 26, 2026 7 min Part 07 of 08

How to encrypt API keys and client secrets in Supabase

Store client secrets in Supabase Vault, keep searchable metadata in Postgres, and gate every decrypt behind one checked SECURITY DEFINER function. Step-by-step SQL with the gotchas.

Jul 7, 2026 40 min Part 08 of 08

How I migrated a live app off Lovable onto my own Supabase and Vercel: the full runbook

Step-by-step runbook to move a live app from Lovable to your own Supabase and Vercel, with rollback gates, real incidents, and fixes.

All articles