igormiazek

If you don't want to consume all project resources on debugging maybe worth test with local supabase instance

Or move project ownership to New account too in case you cannot remove compromised email

Is it from supabase metrics API or supabase dashboard?

I think is only warning for you.

You can continue, if you will use all resources supabase services will be not available for you untill quota renew, after you are above quota you wait or go pro.

Rafa so the problem was related to how you used admin SDK? You did it wrong or there is some issue in SDK. Asking for Curiosity as you stopped using the SDK.

Have you tried to use VPN to connect from different location to see if the problem is related to a location from which you connect?

Async programming and [https://supabase.com/docs/guides/realtime/broadcast](https://supabase.com/docs/guides/realtime/broadcast) and executing Edge Function in async mode [https://supabase.com/docs/guides/functions/background-tasks](https://supabase.com/docs/guides/functions/background-tasks) waithUntil, somebody wrote already that you can evaluate moving it to SQL but I would need to see your function logic first, directly in db it maybe faster

Not sure why this post was removed, it is a very true and real question about how people are using Supabase, as Baas or as Platform.

It was about to start a discussion and see if people are thinking about Supabase as platform rather than only BaaS. You can ask what is the difference ? So platform can host more than 1 app in my opinion.

I agree with you and I think all who apply here on Supabase Discord to get job know that some posts maybe suspicious, you need to be careful, I saw many posts like that but I as well got few nice clients with whom I am still working. I think Supabase doesn't want to create a job marketplace is not their aim, they want that community control it kind of. I agree about Upwork :). But recently I took a different approach, I improved my profile and I have good visibility, some clients started contacting me on their own. Is difficult to get jobs on upwork, you need to be very fast and monitor it 24/7 🙂

In Poland I would say that you did "niedźwiedzią przysługe", you translate that directly "to do more harm than good ". xD "ppmo+" is not mine account brother, take it easy. It seems i was never so smart to apply such marketing activities xD

_crypto_aead_det_noncegen is the name of your EdgeFunction? From the code I don't understand what actor is trying to use the function, could you provide more information?

Hi <@1529241732632281240> I do exactly what you need https://www.itstartechs.com/services/supabase-security-tenant-isolation-audit, I do the audit in few tiers so we can select the depth and precision that you need. I will DM you. We can start with self-service guidebook that you can execute locally.

I wrote an article [https://www.itstartechs.com/post/from-gherkin-to-playwright-ai-generated-tests-for-supabase-applications](https://www.itstartechs.com/post/from-gherkin-to-playwright-ai-generated-tests-for-supabase-applications) that is located in the tone of this post discussion I believe

what you keep in beta\_testers? Is it additional table where you keep some information about those beta testers?

I think he is offering his services 🙂

I have an impression that a lot of people when working with Supabase doesn't think about ORM at all, not sure what was your first project case, because I have backend dev background I cannot imagine working without it, although I wonder about maintainability of procedures and functions with ORM instead writing pure SQL, I saw that Drizzle has some support for it.

u/LorenzoGraz disable signups from supabase dashboard, then add your beta users via invite only, I think that should be enough for you? It happens I provide security services for Supabase. Write to me I will pass you free guide so you can do some security tests on your own [https://www.itstartechs.com/post/practical-guide-to-free-sast-security-analysis-sonarqube](https://www.itstartechs.com/post/practical-guide-to-free-sast-security-analysis-sonarqube)

u/Emergency-Specific72 if you would appreciate from a new pair of eyes, I am providing security audits for Supabase, although I have quite good security guide that is free (some people say so). I am happy to share thoughts and give you and your dev directions [https://www.itstartechs.com/post/practical-guide-to-free-sast-security-analysis-sonarqube](https://www.itstartechs.com/post/practical-guide-to-free-sast-security-analysis-sonarqube)

u/pizzaisprettyneato what ORM you used in the project you described?

u/DiPDiPSeTT how you maintained RPC SQL code? Pure SQL or maybe with some ORM like Drizzle? I am wondering if that would be easier for you if you would use Drizzle? Database centric architecture was populare I guess \~30-40 years above because there was no other choice, now it went back, interesting to look on that and follow the evolution of the platform. I am a full-stack developer and I always worked with backend between FE and db so is hard to adapt to this pattern. I wonder when you would select RPC, Edge Function or dedicated Backend Service? Maybe each execution context as that's how I look on that has it's phase when the system grows. I can imagine that when the system is big enough or part of it I will move it to dedicated backend service.

Oracle introduced interesting concept called PACKAGES, but it is only in PL/SQL. I think the problem is always in data modeling layer u/innovasior, if you divide your project on wrong amount of sub-domains, where for me each sub-domain represent a space that can live independently from other sub-domains, so if you will create borders in wrong places you will experience hell. But if you do it right, your system will ve composed of independent modules, where each could have different execution context. For me it is specially interesting because software is always growing and evolving, architectural decisions must include this growth.

u/alOOshXL for people who understands what domain driven design is, this data architecture issue is a real problem that need to be addressed early one. Are you familiar with single responsibility principle? If yes try to think about that but on data layer, add to that a fact that applications using Supabase use monolith structure (monolith first approach is good), which means you don't have any enforced constrains, all you can do is to enforce your own convention. Software is not a fixed thing, it evolve together with it's business and problem domain, if code base and data layer doesn't reflect that, sooner or latter you will encounter issues related to scalability and data coupling that cross business capabilities boundaries.

u/funkdefied are you programming? Tell me that you never asked AI to wrote a piece of code for you? xD. I have experience as solutions and database architect. The thought is mine and resulted from me mastering Domain Driven Design by Eric Evans.

Hi I wish you an excellent builder, in the meantime I wanted to invite you to read some posts https://www.itstartechs.com/resources related to Supabase security performance and architecture.

Having many projects, make it easier to manage access, you don't want that everyone have access to prod. I am aware that branches are under the hood separate projects but not sure if you can control who can access specific branch if person have access to the project already.

<@922752621478031431> one thing that may simplify debugging for you, remove all policies that are used for the tables with which you have issues and start adding them back progressively, you will catch policies that are causing issue for you.

Unit tests provide the most value for stable and deterministic business logic whose behavior is expected to remain consistent over time. The reason is that unit tests have a maintenance cost. If the code they're testing changes every week because requirements are evolving, then the tests change just as often, slow development and may discourage refactoring. I would use database level unit tests where SQL is stable. I'm curious what your database architecture looks like. Do you separate it into multiple schemas for example, one exposing a stable public interface (RPCs, views, etc.) and another containing the internal business logic? The reason I ask is that this naturally enables **contract testing**. Instead of testing every AI-generated function or trigger, you validate the public contract. As long as the contract stays stable, the implementation can evolve freely. I also think contract testing is a better fit for dynamic projects, while unit tests provide the most value for stable business logic.

You have to wait, based on what you wrote I guess you need concrete data you have in Supabase db that is on hold now. But if not, you can create a seed file to load dummy or realistic data into your db, nothing you would need to do manually.

u/itssdh leaving my contact if still looking after a person [https://www.itstartechs.com/](https://www.itstartechs.com/)

Hi u/Total-Hat-8891 what you selected? I would try to decide based on domain driven design, for me the technology was always secondary, buy vs build comes from business requirements and problem domain. The question is more about if I need short TTM because Supabase give you that, if you preserve isolation betweem domain knowledge and execution context you have many doors open.

if security scan is part of your development flow that's good, but if that's done before pushing the code it means you check only the code base, that's SAST. You need DAST (Dynamic Application Security Testing), testing app during runtime. ZAP is free, fully recommend it. I recently found out that Aikido is using ZAP too for it's scans.

you can host supabase locally https://supabase.com/docs/guides/self-hosting/docker in order to keep developing while Supabase is renewing your project resources

<@1050547846388129962> have you tried to scan your code? I can recommend SonarQube and Semgrep, both have community editions and SonarQube have option to try it out for 14 days on pro plan, you could use that time to scan your code base and find places in your code that can be responsible for not properly handling db connections.

<@527218918981369856> your message is very generic, could you precise what problems you are experiencing? Based on what you wrote you experienced multiple disruption of services, could you list them?

<@1510659607461363803> one way to unblock you so you can still keep developing is to self-hosting Supabase locally, not sure if that's good idea? In the meantime you can check your Supabase security, maybe it had some apis publically available and shouldn't? Worth doing free security scans with ZAP as DAST and some static code checkers to eliminate high severity issues.

<@300730529865531393> what you mean by attack, somebody got access to your supabase account and removed the project?

<@1449646363586334753> if you have all migrations and database logic in the code base, you could create a new instance? So you are not blocked with development and can wait without stress for Supabase suppport to come back to you.

Hi <@1190982649154637835> I have 15 years of experience in IT for last 3 years I specialize in Supabase projects. You wrote that you are not a technical person, if you will have time I have an article about how to approach Supabase rather like building a platform than fragmented apps https://www.itstartechs.com/post/from-one-supabase-app-to-ten-when-you-realize-you-re-building-a-platform. I can review your code base for free and give you a high level opinion about what you have and how to implement remaining features you have on your list (NDA can be signed on your request I have a draft I can share) I will DM you shorly.

There is many open source security tools that are worth including [https://www.itstartechs.com/post/practical-guide-to-free-sast-security-analysis-sonarqube](https://www.itstartechs.com/post/practical-guide-to-free-sast-security-analysis-sonarqube), possibly at the beginning as others said you maybe more vulnerable to other types of attack like supply chain attack, but good security practices is worth doing from day 0. In regards to your concrete question, I think Supabase has some obfuscation out of the box [https://supabase.com/docs/reference/javascript/v1/auth-signup](https://supabase.com/docs/reference/javascript/v1/auth-signup) you would need to test and decide if that's enough for your users protection. But making it possible for attacker to guess if email already has account is not good, you should take care of it or at least being aware about that and plan how you will solve it and when, accordingly to your priorities.

Agree with you, person sending you packed files and push you to run it locally is always very suspicious. Unfortunately that's how it is when people are anonymous like in Discord. Although I was able to meet few really good clients here, so is not always bad. But be cautious.

Thanks <@1409175205485744209> I saw the job post he created was already removed. He wrote back to me as well but I haven't received any files yet.

I agree manual review is still essential and needed, automation security scanning tools aim to support human only not replace human. Although what you are describing can be automated with e2e tests, of course quality of tests matter.

Hi <@1470323184380284969> I have in deep experience in Supabase related to security, performance, observability, architecture and full-stack development. Looking forward to connect with you https://www.itstartechs.com/resources

Hi <@414737824374587393> I am based in Poland, I have working experience with small, medium and large enterprise projects. Currently I specialize in development of supabase projects and data platforms. I worked on projects where lead enrichment and scrapping was done, for example I created a pipeline that scrapped data with: apify, crawlbase or zyte and after enriched that with LLM and inserted to client system for leads management like pipedrive, freshsales or hubspot. I would like to invite you to check my blog section https://www.itstartechs.com/resources I have supabase related articles about security, performance and architecture. Looking forward to know you better.