Curated developer articles, tutorials, and guides – auto-updated hourly


In my previous article, I talked about Train Track, the transit app I built around Metro Manila's...

Transcription, RAG, streaming generation, vision extraction — the only four AI patterns that consist...


Every AI coding agent will happily "audit your RLS" if you ask it to. Mine did. It found three...


A few days ago somebody on Reddit asked how to make proper backups of a Supabase project. My first....


Welcome to our weekly log for the Supabase .NET SDK 🎉 Following the monorepo migration, I started....


A leaderboard looks trivial until it has to be live, global, and correct under load: rank the world....


Overview AuraFinance is a full-stack financial intelligence platform that combines live...


A year ago, the classic Supabase leak was a .env file committed to a public repo. Everyone learned t...


If you've ever stared at a .env.local full of Supabase keys and wondered "wait, which of these is...


Your policy looks right, the SQL editor says it works, but the JS client returns []. Or an insert...


If you've been vibe-coding a Supabase app with Claude Code, Cursor, aider, or an MCP setup, there's ...


You pushed your app, opened DevTools, and there it is in plain sight: your Supabase key, sitting in....


You pushed, then your stomach dropped: .env is in the commit. Maybe a bot already emailed you. Take ...


I build tooling that scans Supabase projects for Row Level Security mistakes, and I keep running int...


Row Level Security is the thing standing between your Supabase tables and the whole internet. Your.....


I build security tooling for Supabase, and I keep finding the same four holes in apps that shipped.....


There is a whole genre of tutorial that takes you from a database table to a paid public API in abou...


If you built something on Supabase with a lot of AI help and you're about to ship it, this checklist...


Quick answer: Lovable app security's most common failure isn't a missing header. It's an unset...


You wrote a tidy Row Level Security policy, something like auth.uid() = user_id, and now one of two....


Every backend-as-a-service vendor eventually hits the same wall: your transactional database is not....