What the internet is saying about Supabase

What the internet is saying about "Supabase backend"

🟢 Supporters

• •Real production adoption. One HN commenter on the Turso acquisition says "Supabase is a great product, we use it for all of our products" [1].
• •Turso deal seen as positive. The acquisition drew 222 points and 117 comments on HN [1], plus 75 points on r/Supabase [8]. Commenters are "excited about Turso as a technology, both as a better sqlite and as something theoretically capable of becoming an embeddable postgres-compatible database" [1].
• •Active first-party shipping.
  • •Supabase announced a Compute private alpha [2].
  • •It released @supabase/middleware, described as free, open source, composable and type-safe middleware for Web Fetch handlers [10].
  • •It published a shadcn-installable way to give your app its own MCP server, so customers can use it from ChatGPT or Claude. Requests run as that customer, so existing access rules decide what they see [6]. This post scored 26, the highest of the non-acquisition Reddit posts.
  • •Supabase is also running user-research outreach, offering swag or credits for 20-minute calls [7].
• •Healthy third-party ecosystem. Community projects include:
  • •a terminal UI (TUI) for Supabase [19];
  • •a Mac app that syncs tables to Excel/JSON in both directions [13];
  • •an offline-first plugin for supabase-kt [15];
  • •lovebase.dev, for claiming a Lovable Cloud instance into your own Supabase [14].
• •Used for serious workloads in GitHub repos. Examples include RLS-backed schemas [22], tenant-scoped data [32], a Stripe Postgres pipeline into a Supabase dev project [33], and caller-role query execution [28]. A hot-updater PR also lists Supabase among its supported storage adapters [20][23].

🔴 Skeptics

• •Widespread RLS misconfiguration in AI-built apps. A scan of about 5,000 public Bolt + Supabase repos found 26% have a table anyone can read [4].
• •Tenant isolation is hard to prove. One poster says that after a year of migrations, isolation is "spread across hundreds of files" and the honest answer to "can another tenant see our data?" is often "we think not." They add that Supabase's own docs list four gaps that remain even with RLS on every table, including views bypassing RLS by default (fix: security_invoker = true) and editable raw_user_meta_data [9].
• •Real security fixes in the wild.
  • •One PR reports a HIGH-severity forged service_role claim bypass, reproduced in production, in which an authenticated caller with null auth.uid() could pass the check [25].
  • •Another removes every anon and USING (true) read on five tenant tables [32].
  • •A third removes hardcoded default admin credentials and keeps build artifacts private [17].
• •Apps break after launch. Of 86 public Supabase apps checked, 31 point at a project address that no longer resolves. The title says 4 in 10 of those posted 6+ months ago now load a page whose database is gone [5].
• •Email deliverability. Supabase + Resend confirmation emails land in spam even with SPF/DKIM/DMARC passing, a 10/10 Mail-Tester score, and Resend showing "Delivered" [12].
• •Turso concerns. Commenters worry Turso might become "another 'incredible journey'" and note that earlier ClickBench attempts kept finding bugs. One says "It should not be X times slower than SQLite" [1].
• •Tooling friction. The existence of tools to escape Lovable Cloud says the existing migration paths "suck" [14]. A PostHog fix addresses Postgres syncs that retry endlessly against Supabase auth.uid()-dependent functions [16].
• •Supply-chain concern. The supabase-js repo is adding an npmscan PR workflow for lockfile changes [3].

⚪ Neutral Observers

• •Turso's own announcement is titled "Turso Is Joining Supabase" and drew only 4 points [11].
• •Some teams are migrating to or away from Supabase. One PR stack targets a migration/supabase-cloudflare branch [38], and another keeps Supabase code behind a feature flag [35].
• •Many GitHub mentions are incidental: auth, quizzes, roles, logins and compliance planning use Supabase as a component [24][26][29][31][39][40].
• •A PR isolates separate public Supabase clients, with separate keys and session storage, for a POS app and an owner console [18].
• •Supabase Compute drew only 3 points and no comments, so there is little reaction yet [2].

Cross-Platform Signals

• •Reddit (r/Supabase) is the most active platform for practical, builder-level content: security audits, tools and troubleshooting.
• •Hacker News focuses on strategy. The Turso acquisition dominates with 222 points, versus 3–4 points for Compute and Turso's own post [1][2][11].
• •GitHub shows Supabase as embedded infrastructure, with a heavy emphasis on RLS, roles and access-control hardening [25][28][32].
• •Consensus: the platform is widely used and the ecosystem is thriving. The recurring theme across Reddit and GitHub is that security, especially RLS correctness, is the main risk. The divergence is that HN debates the Turso acquisition while Reddit and GitHub debate how safely people use the product.

Community Verdict

Sentiment toward Supabase as a backend is broadly positive on adoption, tooling and momentum, driven by the Turso acquisition and a steady stream of first-party and community releases. The loudest criticism is aimed at how it gets used rather than at the platform itself. Misconfigured RLS, weak tenant isolation, abandoned projects and AI-generated apps shipped without security review all recur [4][5][9][32]. The open question is whether Turso gets the resources and open-source continuity commenters hope for [1].

---

Based on Hacker News + GitHub + Reddit data from the last 30 days, researched with last30days by Matt Van Horn.