Supabase
Postgres with auth, APIs, storage and functions on top, and open source
1/2Supabase is a backend platform built on Postgres: every project is a full Postgres database, with the pieces most applications need layered on top rather than assembled separately — authentication enforced by Row Level Security, instant REST and realtime APIs generated from your schema, file storage, Edge Functions and vector embeddings. The dashboard carries a table editor, a SQL editor and a policy editor over that same database, so schema work and queries happen in the browser rather than in a separate client. It is open source and can be self-hosted, and the free tier runs two projects on a 500 MB database, though free projects pause after a week of inactivity.
- Every project is a full Postgres database, portable and extensible
- Authentication with Row Level Security enforced in the database
- Instant REST and realtime APIs generated from your schema
- Edge Functions for custom code with no servers to deploy or scale
- File storage for images, video and other large files
- Vector storage, indexing and search for embeddings
- Table editor, SQL editor and RLS policy editor in the dashboard
- Open source and self-hostable, with branching for schema changes
Based on what people have said
Every answer links back to the mentions it came fromWhat are the common pitfalls when securing data in Supabase?
Users report that data leaks often stem from misconfigured Row Level Security (RLS) policies, such as forgetting to apply them to child tables or using overly permissive settings. Additionally, some warn that the service_role key bypasses all RLS policies and can cause security issues if accidentally included in client-side code.
5 mentions · r/buildinpublic · r/Supabase · r/Supabase · r/Supabase · Aug 2026 – Sep 2026
How does Supabase perform for larger projects or high-scale needs?
Experiences vary; while some find it capable of handling production marketplaces, others report hitting CPU and concurrency limits on the free tier. Some users have encountered performance bottlenecks with storage at scale, and others note that the platform's free tier projects pause after periods of inactivity.
6 mentions · r/Supabase · r/lovable · r/Supabase · r/Supabase · @lucamaraschi · Aug 2026 – Sep 2026
Is it better to use the managed cloud service or self-host?
Opinions are divided. Some users prefer the managed cloud for convenience and to avoid the complexity of self-hosting, while others consider self-hosting to gain more control or to avoid managed plan limits. However, some warn that self-hosting requires significant sysadmin expertise to avoid security misconfigurations.
7 mentions · r/Supabase · r/aws · r/lovable · r/webdev · Aug 2026 – Sep 2026
What do people say about Supabase's reliability and support?
Some users report frustration with occasional outages and slow support response times, particularly regarding billing issues. Others note that many perceived reliability problems are actually related to underlying infrastructure providers like AWS or user-side configuration errors rather than the platform itself.
8 mentions · r/Supabase · r/Supabase · r/webdev · Hacker News · Aug 2026 – Sep 2026
How does Supabase compare to other backend-as-a-service options?
It is frequently compared to Firebase, Appwrite, and Xano. Some users find Supabase preferable for its Postgres foundation and control, while others suggest alternatives like Pocketbase for simpler needs or Convex for newer projects. Some users also note that for very simple internal tools, built-in database options in frontend builders might be sufficient.
6 mentions · r/hackathon · r/webdev · r/nocode · @omkarships · @jamesdevonport · Aug 2026
These summarise counts and dates only. Read the quotes themselves under what people are saying.
What people are saying about Supabase
50% neutral“Supabase exposes your tables over PostgREST with the anon/authenticated keys that ship in the browser. If RLS is off, or a policy is \`USING (true)\`, or you only put policies on the parent table and forget child tables, anyone who can open the published URL can often read/write more than your UI shows.”
“I don't think I'd trust my sysadmin abilities to not accidentally leak my real user data for self hosting, let alone auth”
“I thought preview branches on supabase automatically use the same configs as the base”
“Honestly, don't bother—it's not worth the hassle. I gave it a shot and ended up moving right back to Supabase Cloud.”
“Aws is not the only vps provider, there are extremely cheaper alternatives such as hertzner, ovh ecc. which are less expansive than the supabase official plans”
“I was facing some issues with supabase hard limits edge functions like cpu time or concurrency limits on supabase db, which im guessing can be configured if its self-hosted?”
“the RLS part is the half people actually get wrong, worth adding that the service_role key skips every policy you write. lovable will happily drop it into something that ends up in the browser bundle if you let it.”
“> I'm planning to move an existing production backend from managed Supabase to a self-hosted Supabase deployment on AWS.”
“Supabase is a solid pick, and the invite-only part is the easy half.”
“I’ve been looking into Supabase for authentication and the database. Does it sound like a good option for this kind of setup?”
“I’m considering moving an existing production app from managed Supabase to self-hosted Supabase on AWS EC2 because the project is starting to outgrow the Free plan limits.”
“For your current architecture, Next.js + Supabase/PostgreSQL can be perfectly reasonable if Supabase is handling things like authentication and controlled access to the data.”
“i'd keep n8n strictly in its lane, automation and orchestration. the moment you start treating it like a backend, things get messy. your webhook hits n8n, it does its processing dance, and then fires the result somewhere your app can actually use.”
“I have an n8n workflow that is already working, and I am now looking at building a web interface for it.”
“Lovable and Supabase can support this, but the important decision is not Lovable Cloud versus external Supabase. It is how money and ownership work in the marketplace.”
“Supabase under the hood is not a weakness — it's the best thing about Lovable. It's Postgres, it's what thousands of real companies run on, and it'll handle a marketplace fine. The question isn't "can Lovable build it", it's "can you keep it working once vendors and money are involved".”
“I've been building a multi-tenant app on Supabase and audited my policies before shipping. Found a bug worth sharing, because I suspect it's fairly common.”
“Our applications are deployed to Vercel and access a common Supabase DB that lives in a separate Github repo. The Supabase repo auto-executes pending migrations using Supabase's Github integration.”
“The image-pull time is the real killer, not the CLI init. If you cache the docker layers with actions/cache keyed on the supabase CLI version + your schema hash, you can cut a warm run to under 30s.”
“The image-pull time is the real killer, not the CLI init. If you cache the docker layers with actions/cache keyed on the supabase CLI version + your schema hash, you can cut a warm run to under 30s.”
“is supabase down in India?”
“yeah, 1. Failed to fetch (auth.supabase.io)”
“are u guys facing issues with supabase login ?”
“It happened only yesterday, and I noticed Supabase pro tier keeps up to previous 7 days backed up. I am wondering if I were to upgrade to it now, if I would be able to restore the data from couple days ago even though I wasn’t subscribed to pro tier until after?”
“I treat PostgreSQL in Supabase as the source-of-truth state machine instead of managing state in n8n. Document statuses use strict enum types (pending, received, under\_review, approved, rejected), and all transitions run via atomic PL/pgSQL RPC functions.”