Loading…
Supabase
Open-source backend platform providing PostgreSQL databases, authentication, storage, realtime APIs, and serverless functions.
- 230 posts summarised
- latest
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
From their blog
Latest articles
Agentic Coding on Supabase with OpenCode
Supabase has made its OpenCode integration available, connecting an AI coding agent to Supabase account and project management APIs and bundled Supabase skills. Users invoke /supabase, authenticate, and, for database, Edge Functions, logs, and other project-scoped capabilities, are guided through connecting Supabase MCP; the integration requires OpenCode 1.3.4 or later. It can list organizations and projects, create projects, open the MCP setup flow, monitor agent activity in real time, and let agents query data, check logs, and deploy functions, while the plugin is open source. The post demonstrates the workflow in Minecraft, where OpenCode connected through MCP, created and populated a table, and deployed an Edge Function on a real Supabase project.
Multigres v0.1 Alpha: an operating system for Postgres
Multigres v0.1 alpha is an open-source release of a system intended to provide Vitess-grade horizontal scaling, high availability, and operational simplicity for Postgres. It manages Postgres instances with sharding, connection pooling, automatic failover, and backup orchestration, while this release adds advanced pooling, automatic failovers, and a Kubernetes operator. Its high-availability protocol builds on unmodified Postgres replication, supports user-defined durability policies, resolves split-brain scenarios without losing succeeded commits, and permits replica changes while running. The release is suitable for experimentation but not production workloads: v0.1 is single-shard, sharding is absent, the custom-resource API may change, backward compatibility is not guaranteed, and performance benchmarks are still in progress.
Supabase Series F
Supabase has raised a $500M Series F at a $10B pre-money valuation, led by GIC. Existing investors participated, Stripe invested again, and Georgian and Salesforce Ventures joined as new investors; the funding will accelerate open-source and Postgres tooling, support growth, and provide employee liquidity. Supabase is also releasing Multigres v0.1 alpha, an open-source, self-hostable scalable operating system for Postgres designed to provide high availability and operational simplicity; a future release is intended to add Vitess-grade horizontal scaling. The alpha is ready to try but not production-ready, with production-readiness expected in a few months. Over the past year, database launches grew 600%, more than 60% of new databases came from AI tools, and nearly 10 million developers built on Supabase.
Protecting your Supabase projects from npm supply chain attacks
The post explains why npm supply-chain attacks matter to Supabase projects: Edge Functions, the Supabase CLI, and packages including supabase-js, @supabase/ssr, and @supabase/server all depend on npm. Attackers can compromise maintainers, register typosquats, or exploit build pipelines; once malicious code reaches node_modules, lifecycle scripts may read environment variables, cloud metadata, tokens, kubeconfig, and SSH keys. The proposed defense is layered: upgrade to pnpm 11, increase minimumReleaseAge to several days, pin sensitive dependency versions, commit and review lockfiles, disable or allowlist install scripts, verify package names, and pin GitHub Actions to full commit SHAs. Supabase is publishing a canonical security guide, hardening its GitHub Actions, adding secret-handling warnings to API documentation, and coordinating communications; the post also recommends rotating credentials after a potentially compromised install and using scanners as supplementary defense.
Supabase Is Now an Official ChatGPT App
Supabase is now an official app in ChatGPT, allowing users to connect Supabase projects and manage database infrastructure through conversation. The app provides 29 tools for executing SQL on Postgres, designing and modifying schemas, listing tables and extensions, checking security recommendations, and handling project operations such as logs, costs, pausing, and restoring. It also supports development branches and migrations, serverless edge functions, and direct Supabase documentation search, while ChatGPT Projects can scope chats to a project reference. Users install it from ChatGPT’s app directory, authorize access to their Supabase organization, and can use it on all Supabase plans with paid ChatGPT plans. The stated result is conversational management of Supabase projects without leaving ChatGPT.
Introducing @supabase/server
Supabase is releasing @supabase/server in public beta, a package for authentication verification, client setup, request context, and common server-side boilerplate across backend runtimes. Supabase says an anonymous analysis of 25,000 deployed Edge Functions found developers repeatedly rebuilding setup for clients, JWT verification, claims parsing, CORS, auth context, and shared files. The package's withSupabase wrapper or createSupabaseContext function supplies a SupabaseContext containing a user-scoped client, service-role admin client, verified identity, JWT claims, auth metadata, and auth mode, while declarative modes cover user, none, secret, publishable, or combined access. It returns standard Request-to-Response handlers for Edge Functions, Vercel Functions, Cloudflare Workers, Hono, Bun, and Deno, and includes primitives for custom middleware and adapters. @supabase/server does not replace @supabase/ssr, which remains focused on cookie-based sessions, and the release invites feedback on its public-beta API and adapters.
Realtime or Pipelines? How to choose the right tool
Supabase Realtime and Supabase Pipelines both read PostgreSQL changes through logical replication, but they target different jobs. Realtime delivers live updates and communication to browsers and apps through Broadcast, Presence, and Postgres Changes; its Postgres Changes path checks Row Level Security for subscribed users, uses temporary replication slots, and offers best-effort delivery without replay after disconnects. Pipelines is a managed change-data-capture system that performs an initial sync, then replicates selected publication data in batches to supported analytical destinations through a persistent replication slot, retaining progress and retrying transient failures. The choice depends on the destination and delivery needs: use Realtime for low-latency user experiences that can tolerate gaps, Pipelines for durable analytical copies with at-least-once processing and idempotent destination writes, and both when an application needs both capabilities.
Branching Without Git Is Now The Default
Supabase has made dashboard-based database branching the default for all projects, adding a GitHub-free alternative to its existing git-based workflow. Developers can create a branch from the dashboard, work in the SQL Editor or Table Editor against a separate Postgres instance, review a schema diff, and merge changes into production without Git configuration. The workflow uses pg-delta, a new schema-diffing engine in pg-toolbelt that covers tables, columns, RLS policies, functions, triggers, indexes, and extensions, replacing migra as dashboard branching’s default engine; pg-delta is alpha software and is also available in the CLI behind a flag. Git-based branching remains fully supported, and the two approaches can be switched between or used together, while branches created through the Supabase MCP server use dashboard branching automatically.
Introducing the OSSCAR Index
Supabase has launched the OSSCAR Index, a quarterly ranking of fastest-growing open source organizations, with the site, data, and scoring code released as open source. It addresses the limits of rankings based on accumulated stars, downloads, or contributors by measuring community growth within two divisions: Emerging organizations below 1,000 GitHub stars at quarter-start and Scaling organizations at or above that threshold. Scores combine normalized net new stars, unique contributors, and npm, PyPI, and Cargo downloads using an L² norm, with minimum thresholds and no penalty for missing or declining signals. The Q1 2026 edition identifies Openclaw as a breakout project, places AI-agent projects prominently in Emerging, and reports global representation; quarterly updates, expanded package coverage, an RFC process, and historical rankings are planned.
Supabase is now ISO 27001 certified
Supabase announces certification to ISO/IEC 27001:2022, covering its information security management system across Database, Auth, Storage, Realtime, Edge Functions, and the Data API. The post explains that ISO 27001 defines how an ISMS manages information risk through documented policies, processes, and controls, with certification awarded by an accredited third-party auditor after documentation review, interviews, evidence sampling, and control testing. Preparation included formalizing informal policies, documenting risk assessments, running internal audits, selecting an auditor, and mapping existing SOC 2 controls to ISO 27001 Annex A to avoid duplicate evidence collection. The certificate is valid for three years with annual surveillance audits, and Team or Enterprise customers can request it from their dashboard; the certification is presented alongside existing SOC 2 and HIPAA support.
We're Transferring the Stripe Sync Engine to Stripe
The Stripe Sync Engine repository is moving from supabase/stripe-sync-engine to stripe/sync-engine after growing from an open-source tool for syncing Stripe data into a Stripe schema in Postgres. The transfer follows collaboration that added cursor-based incremental sync, JSONB storage with generated columns, multi-account support for Stripe Connect platforms, event ordering in a new CLI, and automatic incremental backfilling using Supabase Cron and Queue. The latest release adds coupon synchronization, branching support, immediate syncing on installation, one-click upgrades, SSL enforcement, and tighter installation controls, along with clearer errors and dashboard visibility for Edge Function source code. The project remains open source under Apache 2.0, existing installations continue to work, and the Supabase dashboard integration is unchanged. With Stripe data in Postgres, users can join it with application data for subscription checks, feature gating, MRR, and churn analysis.
AI Agents Know About Supabase. They Don't Always Use It Right.
Supabase is releasing Supabase Agent Skills, an open-source instruction set for AI coding agents working with Supabase through Claude Code, Codex, GitHub Copilot, Cursor, and compatible Agent Skills implementations. The skill addresses recurring errors such as omitted RLS policies, hallucinated CLI commands, views missing security_invoker = true, and reliance on outdated training data by requiring documentation checks and embedding critical security guidance in SKILL.md. It also guides CLI and MCP workflows and recommends direct schema changes on local or staging databases, followed by database advisors and a migration after the schema stabilizes. Early evaluations across six scenarios found MCP + Skill scores of 67% for Claude Opus 4.6, 71% for Claude Sonnet 4.6, 88% for Codex GPT-5.4, and 71% for GPT-5.4 Mini, though the sample was small.
Custom OIDC Providers for Supabase Auth
Supabase has launched Custom OIDC Providers, enabling projects to connect standards-compliant external OpenID Connect identity providers beyond its built-in social options. Configuration requires an issuer URL, client credentials, and scopes; Supabase automatically resolves the discovery document, endpoints, and JWKS, and verifies ID tokens against the provider’s JWKS. After enablement, users use the standard OAuth sign-in flow through existing JavaScript, Flutter, or Swift clients, while the auth server handles redirects, code exchange, profile retrieval, and user creation or linking. Custom providers include default PKCE, authorization-parameter support, multi-platform audience validation through acceptable_client_ids, and an email_optional setting for providers that do not return email addresses. They can be created, listed, updated, or deleted via the Dashboard or Admin API, with a limit of three per project.
100,000 GitHub stars
Supabase reports reaching 100,000 GitHub stars and says eight million developers are building with the platform. Founded in 2020 by two people around a Postgres database, the project says it optimized for developers having a good time rather than for star counts, treating the milestone as evidence of a community that contributed, stayed involved, and built unexpected projects. Its open-source approach centers on supporting existing tools and communities: projects run unmodified Postgres, PostgREST handles billions of API requests daily, pgvector stores embeddings, Deno underpins Edge Functions, imgproxy handles image transformations, and Phoenix supports Realtime at almost 1.5 billion messages per day. The team says it aims to help make Postgres the default database for new internet projects, including by pursuing petabyte scale and pluggable storage.
Supabase docs over SSH
Supabase is launching supabase.sh, a free public SSH server that gives AI coding agents bash access to Supabase documentation as a public experiment. Its virtual file system exposes every documentation page as a Markdown file under /supabase/docs, allowing agents to use familiar commands such as grep, find, ls, cat, head, and tail to browse, search, and skim current content. The service runs on just-bash, Vercel’s open-source Bash emulator written in TypeScript, inside a sandboxed JavaScript runtime over a virtual file system, so it does not execute an actual shell on the server. Project instructions can be added with ssh supabase.sh agents >> AGENTS.md or generated through ssh supabase.sh setup | claude; the post contrasts this exploratory workflow with the existing search_docs MCP tool and presents supabase.sh as an early experiment.
Navigating Regional Network Blocks
Supabase describes how regional network blocks disrupted access to its multi-tenant developer platform and shares three incidents from September 2025 through March 2026. It explains that DNS-level or transport-layer blocking can affect every tenant when projects share domains and IP addresses, while adding a hosting domain to the Public Suffix List provides only partial mitigation. In the UAE, a project distributing unauthorized streaming content triggered an approximately 18-day block that ended after removal and engagement with the TDRA. Yemen saw TCP connections dropped for about eight days with no official explanation, while India’s roughly eight-day restriction was rescinded after project enforcement and technical engagement with MeitY. The post says providers should build regulator contacts, strengthen abuse response pipelines, and develop alternatives such as proxy domains, custom domains, and other workarounds.
Supabase Joins the Stripe Projects Developer Preview
Supabase has joined the Stripe Projects developer preview, a Stripe CLI workflow for provisioning real services and obtaining working credentials with a single command. The integration provisions a complete Supabase project—including Postgres, Auth, Storage, Edge Functions, and Realtime—without requiring dashboard interaction, while supporting both developers and AI agents through deterministic, repeatable steps. After installing the Stripe CLI and adding supabase/project, stripe projects env --sync writes credentials to a local .env file and stores them in the Stripe Project for agent access; existing Supabase users can link their account. Projects remain in the user’s Supabase account with dashboard, connection-string, and data access, and database credentials can be rotated with stripe projects rotate supabase/project. The feature is a developer preview, and Stripe and Supabase are requesting feedback through Discord or GitHub.
Log Drains: Now available on Pro
Supabase has launched Log Drains for its Pro tier, allowing users to send Supabase logs to their own logging backend and investigate them alongside the rest of their stack. The feature addresses the separation between Supabase logs and external observability tools by exporting events from Postgres, API Gateway, Auth, Storage, Edge Functions, and Realtime. Logs are sent over HTTP in batches of up to 250 entries or every second, whichever comes first, with Gzip compression when supported by the destination. Supported destinations include Sentry, Grafana Loki, Datadog, AWS S3, Axiom, and generic HTTP endpoints; users configure drains in the dashboard and can create multiple drains, with pricing of $60 per drain per project, $0.20 per million events, and $0.09 per GB of egress.
Supabase Storage: major performance, security, and reliability updates
Supabase Storage has shipped updates live in all regions for projects using Storage, targeting performance at scale, security vulnerabilities, and reliability issues. As projects reached tens of millions of objects, concurrent uploads exposed write bottlenecks, certain SQL deletes could orphan files, and a crafted path could escape the file backend’s storage root. The object-listing rewrite removes the prefixes table, six triggers, and twelve helper functions, derives folder structure from the objects table with a hybrid skip-scan algorithm, and uses cursor-based pagination; deep pagination on 60 million rows is up to 14.8 times faster without a write penalty. Direct SQL deletes are blocked by default through a statement-level trigger, while a configurable 30-second timeout supports cancellation of disconnected clients via native Postgres protocol. Idempotent migrations, TUS lock-race prevention, orphan-scanner fixes, OpenTelemetry metrics, and adapter and API bug fixes are included, with no code changes required.
Supabase incident on February 12, 2026
Supabase reports a 3-hour-and-42-minute outage on February 12–13, 2026, affecting every service in its us-east-2 region, including Postgres, Auth, Data APIs, Edge Functions, Storage, and Realtime. A deployment of an internal monitoring service enabled AWS VPC Block Public Access in block-bidirectional mode, blocking internet gateway traffic across production VPCs in the region. The incident response was delayed because alerts pointed toward shared services, the relevant CloudTrail event was inconspicuous, pre-production lacked us-east-2, and infrastructure specialists were not involved initially. Supabase restored connectivity by rolling back and removing the monitoring stack, then audited regions, added AWS Organizations policies and IaC safeguards, and planned account isolation, external connectivity probes, production-parity testing, and improved escalation.
Topics they write about
All topics →Weekly digest
The best engineering reads, once a week.