ls ~/writing --tag=supabase

[01]Writing · Tag

Articles tagged "supabase".

$ tag --stat supabase
Articles
11
Published
Mar→Jul 2026
Reading time
111 min
In series
3

Articles tagged supabase

11 articles

40 min [lovable][supabase][vercel]

How I migrated a live app off Lovable onto my own Supabase and Vercel: the full runbook

Step-by-step runbook to move a live app from Lovable to your own Supabase and Vercel, with rollback gates, real incidents, and fixes.

Supabase Production Hardening 8/8

lovable-to-vercel-supabase-migration--cover
A routine Supabase branch merge deleted the entire dev environment, permanently.

7 min [supabase][supabase-vault][postgres]

How to encrypt API keys and client secrets in Supabase

Store client secrets in Supabase Vault, keep searchable metadata in Postgres, and gate every decrypt behind one checked SECURITY DEFINER function. Step-by-step SQL with the gotchas.

Supabase Production Hardening 7/8

supabase-vault-encrypt-client-secrets--cover
A leaked backup or one overbroad rule, and your clients’ passwords are plain text.

7 min [chrome-extension][manifest-v3][supabase]

How to build a Chrome extension popup with Supabase Auth (step by step)

Wire Supabase Auth into an MV3 popup: bundle the UMD, persist sessions in chrome.storage, recover state on reopen. Working code included.

Chrome Extension Lifecycle 2/3

chrome-extension-popup-supabase-auth--cover
Every time the Chrome popup closes, your user is logged out again.

7 min [supabase][supabase-auth][supabase-publishable-key]

Migrating to Supabase publishable keys broke my Chrome extension. Here is the fix.

sb_publishable_* keys return 401 from hand-rolled fetch. Migration to @supabase/supabase-js plus a chrome.storage.local session adapter for Manifest V3. 158 lines of HTTP became 67.

Claude Code Engineering 7/9

supabase-publishable-keys-chrome-extension-auth-fix--cover
They sign in, close the popup, and thirty seconds later they are logged out again.

9 min [lovable][lovable-security][supabase]

How to audit a Lovable app after the BOLA disclosure: a 6-hour rotation playbook

Audit a Lovable app after the BOLA disclosure: exposure checks, Supabase key rotation, Chrome extension SDK migration, and pre-revoke verification.

Claude Code Engineering 6/9

lovable-bola-disclosure-6-hour-rotation--cover
Five API calls from a free Lovable account read your database credentials and your API keys.

7 min [supabase][supabase-realtime][security]

Realtime broadcast scope is a security boundary, not a routing convenience

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

Supabase Production Hardening 6/8

supabase-realtime-broadcast-security-boundary--cover
Anyone who opens DevTools can subscribe to your Supabase channel and read every message.

6 min [security][supabase][auth-jwt]

User enumeration via password reset: the bug in default forgot-password flows

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

Supabase Production Hardening 5/8

user-enumeration-password-reset-leak--cover
Your forgot-password form will tell a stranger which of your customers have accounts.

7 min [security][supabase][edge-functions]

Origin validation in edge functions: the open redirect you ship by default

Edge functions that trust the Origin or Referer header for redirect URLs are open-redirect vulnerable. One allowlist helper closes the gap.

Supabase Production Hardening 4/8

origin-validation-edge-functions-open-redirect--cover
Your own domain hands the user to the attacker’s copy of your login page.

8 min [postgres][supabase][postgres-triggers]

How to build a tamper-evident audit log in Postgres with one trigger

Build an audit log table, attach a SECURITY DEFINER trigger that captures every UPDATE and DELETE, lock it down with RLS. Forty lines of SQL.

Supabase Production Hardening 3/8

audit-log-postgres-trigger-tutorial--cover
I never made that change.

6 min [supabase][postgrest][postgres]

How a Postgres constraint rename silently broke production via PostgREST

PostgREST resolves onConflict against real constraint names at runtime. Rename a constraint and the upsert silently fails with a 400 nobody notices.

Supabase Production Hardening 2/8

postgrest-upsert-constraint-rename-fragility--cover
The migration ran clean on Tuesday. On Thursday nobody could invite anyone.

7 min [supabase][supabase-auth][postgres]

Two-layer identity models in Supabase: when auth and authorization disagree

Supabase Auth creates identities, not roles. Use a user_roles table, RLS policies, and one trigger migration so signups never strand users without permissions.

Supabase Production Hardening 1/8

two-layer-identity-models-supabase--cover
The user did something weird.

[02]Narrow it down

[03]Read in order

3 series run through this tag.

All articles