Supabase is an open-source alternative to Firebase

Awesome Supabase

A curated list of awesome things related to Supabase.

Supabase is an open source alternative to firebase helping in the process of developing a customizable backend for your application. You can start a project with a database, authentication and other things quickly.

Contents

• SDKs
• Postgrest
• Realtime
• GoTrue
• UI Components
• Projects Using Supabase

SDKs

• supabase-js - Supabase official SDK for JavaScript/Typescript.
• supabase-py - Supabase official SDK for Python.
• supabase-dart - Supabase SDK for Dart (Flutter) (community).
• supabase-csharp - Supabase SDK for C# (community).

Postgrest

• postgrest-kt - Postgrest library for Kotlin.
• postgrest-dart - Postgrest library for Dart.
• postgrest-csharp - Postgrest library for C#.
• postgrest-py - Postgrest library for Python.
• postgrest-rs - Postgrest library for Rust.
• postgrest-swift - Postgrest library for Swift.
• postgrest-js - Postgrest library for JavaScript.

Realtime

• realtime-csharp - Realtime library for C#.
• reatime-dart - Realtime library for Dart.
• realtime-js - Realtime library for JavaScript.
• realtime-py - Realtime library for Python.

GoTrue

• gotrue-csharp - GoTrue for C#.
• gotrue-js - GoTrue for JavaScript.
• gotrue-dart - GoTrue for Dart.
• gotrue-java - GoTrue for Java.
• gotrue-kt - GoTrue for Kotlin.

UI Components

• next-server-components - Next Server Components.
• refine - A React-based framework for building data-intensive applications in no time.

Blogs

• Introduction to supabase and Auth
• Fix "new row violates row-level security policy" in Supabase - Troubleshooting guide for INSERT/UPDATE failures caused by missing or failing WITH CHECK policies.
• Supabase service_role key: safe usage and exposure checklist - Checklist for keeping the service_role key off the client and rotating it after exposure.
• Supabase anon key exposed: safe or dangerous? - Explains when a public anon key is expected and when missing RLS makes it dangerous.
• Supabase MCP safe setup for Cursor and Claude Code - Guardrails for connecting AI coding tools to Supabase without leaking secret keys.
• Supabase Oct 30 grants change: fix 42501 on new tables - Why new public tables return permission denied (42501) after Oct 30, 2026 even with RLS on, and the GRANT SQL to fix it.
• Supabase growth teardown: 111,751 stars and 19.9M weekly downloads, what the numbers actually measure - Evidence-cited analysis of Supabase's growth metrics with sources marked as fact, inference or opinion.
• Security checklist for Lovable, Bolt and Cursor apps - Eight checks to run before real users join an app built with Lovable, Bolt or Cursor on Supabase: RLS, keys, storage, ownership checks and secrets.
• Supabase "permission denied for table" (error 42501): why new tables break and the fix - Request-by-request test of the Oct 30, 2026 grants change on a Supabase test project, including recreated tables and new views, with the per-table GRANT, RLS and policy fix.

Tools and Extensions

• GuardLayer - Free static security scanner for Next.js + Supabase apps; flags exposed keys, missing/disabled RLS, over-permissive policies, and unprotected routes on every push, with the exact fix.

• backupdrill - Back up the database and Storage files to your own bucket, with scheduled restore-verification drills (MIT CLI).

• Bible School LMS - Free, open-source LMS built on Supabase (Auth, Database with RLS, Storage). Designed for Bible schools and nonprofits.

• Edge Worker - Library that Supercharges Background Tasks and Supabase Queues

• MailKite SaaS Starter - Open-source Next.js 15 SaaS starter kit with self-contained auth (Google/GitHub OAuth + email/password), Stripe subscriptions, teams, and Postgres on Supabase (Drizzle ORM).

• supabase-plus - An extra set of tools for managing Supabase projects, going beyond the possibilities of the regular Supabase CLI.

• Nemesis Shield - Wrap a Supabase Edge Function in a positive-security WAF with one line (withShield from jsr:@nemesis-shield/edge); it learns each function's normal requests and blocks the rest. Open-source SDKs (MIT), free tier.

• Seatbelt Lite - Claude Code plugin that refuses views in public without security_invoker before the SQL is sent through MCP, so an AI agent can't expose rows to the anon key (MIT).

• supabase-rls-leak-demo - Minimal reproducible Supabase/Postgres RLS isolation failure that runs entirely in PGlite (no cloud project or credentials), plus a free read-only audit SQL that flags RLS-disabled tables, permissive USING(true) policies, and cross-tenant read/write leaks (MIT).

• 1bench - Paid desktop client for Supabase Postgres with pgvector support.

• HTMLRadar - Hosted service that turns an HTML file into a tracked share link with per-viewer read analytics, built on Supabase and Cloudflare Workers.

• RowShield - Checks a deployed Supabase app from the outside for tables and storage that anonymous callers can read, with a free read-only probe; paid plans add scheduled RLS policy and drift checks.

• Ekwo OS - Open-source double-entry accounting core as Postgres migrations: RLS on every table, versioned country packs, import of existing books, a CLI installer and an MCP server (AGPL-3.0; format libraries MIT).

• supabase-security - Lints supabase/migrations with no credentials for the Oct 30, 2026 Data API grants change: tables and views with no GRANT, grants to anon on tables with RLS off, blanket on all tables grants, SECURITY DEFINER functions callable through PUBLIC. Proposes least-privilege grants that mirror your policies; CLI and GitHub Action (MIT).

• Supabase RLS self-audit - Two read-only SQL queries for the SQL Editor. The RLS audit flags tables with RLS off, USING (true) policies, policies not tied to the caller, views without security_invoker, API-callable SECURITY DEFINER functions and open storage policies, with the fix for each. The grant check covers the Oct 30, 2026 Data API grants change: whether new tables are still auto-granted, tables service_role or authenticated cannot reach (with the grant to add), and reachable tables with RLS off (MIT).

• AltoRank - Open-source SEO content software built on Next.js + Supabase: readiness checks, keyword research and drafts into a review queue, with a hosted MCP server (AGPL-3.0).

• looot-tables - Open-source Clay alternative for developers: enrichment tables on Supabase Postgres and Next.js (MIT). Import a CSV, add a column that runs a looot data API call (work email, company data, Google results), see the cost before it runs. Needs a looot API key; no demo mode.

• FixLoop Supabase grants checker - Free browser tool for the Oct 30, 2026 Data API grants change. Paste migrations to find new public tables with no GRANT (they return 42501 even with RLS on) and copy least-privilege GRANT statements. SQL stays in the browser, no signup.

• Next.js Supabase Stripe Security Checker - Free CLI and GitHub Action that scans Next.js + Supabase + Stripe repos for common mistakes: service-role keys in client code, tables without RLS, write policies with using (true) and unsafe Stripe webhooks; 24 checks, runs locally (MIT).

• RLS Radar - Free, read-only check of a deployed Supabase app from the outside: detects keys shipped in the frontend bundle, flags exposed service_role/secret keys, and lists tables and storage buckets that answer to the anon key (counts only, no rows stored). Requires an ownership confirmation.

• SupaBaseFolder - macOS menu bar app that mirrors every table into a folder as live .xlsx/.json files and syncs edits both ways over Realtime, with an offline queue, bulk-delete confirmation and a restore log (MIT).

• instancez - Backend for Developers and Agents - single-binary, runs anywhere.

• supabase-email59-send-hook - Send Email Hook as an Edge Function: sends sign-up, magic link, password reset, invite and email change emails through the email59 API, with no SMTP or domain setup; checks the hook signature and has no dependencies (MIT).

• VibeRaven - Open-source CLI that checks AI-built Supabase + Vercel apps for launch gaps before you ship: tables without RLS, USING (true) policies, service_role keys in client code, SECURITY DEFINER functions the anon key can call. Reads your repo and migrations locally with npx -y viberaven check; a repo check, not a live database test (MIT).

• FastAPI Supabase Starter - Paid SaaS starter for Python: a FastAPI backend that calls Supabase with each caller's token, so RLS covers the web app, API keys and its MCP server. Organizations, roles, Stripe and Razorpay, AI assistant.

• validra-check - Fast, read-only CLI scanner to find exposed Supabase tables, missing RLS policies, and leaked secret keys in web apps.

• SniffPup - Free passive outside scan of a deployed Supabase web app: flags service_role/secret keys shipped in the frontend and tests whether the public anon key can read your tables, plus public .env/.git files and missing security headers. Website and GitHub Action (sniffpup/scan-action, MIT).

• Tuvio - Flags row level security policies that leak data in your Supabase SQL migrations (open to anyone, open to any logged-in user, RLS off, trusting user_metadata, SECURITY DEFINER without search_path), plus keys in git history and the live site. Free scans.

• RLS Check - Free check for the Supabase RLS mistakes the Security Advisor misses: policies that let signed-out visitors in (auth.uid() is null or ...), users who can change their own role, policies that trust user_metadata, delete-anyone policies and open storage buckets. Run one read-only query in the SQL Editor and paste the result; the analysis runs in your browser, nothing is uploaded, no signup.

• SpacePost - Resend-compatible transactional email API on Amazon SES (EU company), SMTP relay + MCP server. Step-by-step custom SMTP setup for Supabase Auth emails, tested on a hosted project.

• SiftingIO Wrapper - Read-only WebAssembly foreign data wrapper for Supabase/Postgres to query SiftingIO market data with SQL; Apache-2.0 code, SiftingIO API key required.

• Reeve Supabase backups - Hosted backups for a Supabase project, taken from outside it and on the free plan too: the database through a read-only key, plus the files your users uploaded to Storage, on a schedule. Copies are encrypted and kept off the project, so deleting the project does not take them with it. Every copy is read back and each table's row count compared against the database before it counts as verified, a restore puts rows and files back behind one button after saving current state first, and the database downloads as a standard dump whenever you want it. Paid, with a free trial. The dump-and-verify half on its own is free as a GitHub Action: supabase-backup-action (MIT).

• Madsalt Supabase Checker - Free read-only check of a Supabase project from the inside: approve read-only OAuth for one project and get 46 checks on RLS, policies, grants, auth settings, storage and Edge Functions, with fix SQL for each finding. Never reads table rows or keys.

• supabase-rls-check - Offline CLI and GitHub Action that scans SQL migrations for tables without RLS, USING (true) policies and public storage buckets, and frontend code for service-role key leaks (MIT).

If you want to add you project here, please create a pull request for it