Postgres best practices for Supabase apps

Supabase Row Level Security: how to turn it on and get it right

Turn on RLS, write one policy per command, test as a real user and avoid the five policy mistakes that leak data in Supabase apps.

How to make Supabase RLS policies fast

Make Supabase RLS fast: wrap auth.uid() in a select, index policy columns, name the role, avoid joins in policies and filter in the query too.

Multi-tenant RLS in Supabase: keep each team's data apart

Isolate teams and orgs in Supabase with a memberships table, tenant_id on every row, app_metadata claims and tests that prove one tenant cannot read another.

Supabase API keys: which key goes where, and what to do when one leaks

Which Supabase key goes where: publishable and anon keys in the browser, secret and service_role keys only on servers, and what to do when one leaks.

Views and functions that bypass RLS, and how to lock them down

Stop Supabase views and RPC functions from bypassing RLS: use security_invoker views, a private schema, an empty search_path and revoked execute rights.

Postgres indexing on Supabase: what to index and how to check it

Index foreign keys and RLS columns, pick B-tree, GIN or partial indexes, order composite columns right and confirm the plan with explain analyze.

Supabase connection pooling: which connection string to use

Use Supavisor transaction mode (port 6543) for serverless and edge functions, session mode for long-lived servers, and turn off prepared statements.

Pagination in Supabase: use keyset, not offset

Replace offset pagination with keyset (cursor) pagination in Supabase and Postgres: faster deep pages, stable results and an index that matches.

Postgres schema design for Supabase apps: rules that prevent bugs

Schema rules for Supabase: uuid keys, timestamptz, numeric for money, check constraints, jsonb, private schemas and RLS in the same migration.