Postgres Guides: RLS, pg_cron and Functions
Doing the heavy lifting in the database: row-level security, SECURITY DEFINER functions, pg_cron jobs and vector search, with what went wrong along the way.
11 articles
Scheduled Jobs in Supabase with pg_cron: A Practical Guide
How to run scheduled jobs inside Postgres on Supabase with pg_cron — idempotent schedules in migrations, catch-up logic, locking down job functions, outbound HTTP with pg_net, monitoring runs, and the free-tier pause.
Supabase Security Definer Functions: The Hidden Exposure
In Supabase, public-schema functions are callable over the API — and SECURITY DEFINER ones bypass row-level security. What our audit found in 117 such functions, the real damage paths, and the grants and rules that close them.
Timezone Bugs in Web Apps: The Ones We Actually Hit
Real timezone bugs from a production app — a due date showing the previous day, "today" starting at the server's midnight, server-rendered times in the wrong zone — why each happened, and the rules that prevent them.
Supabase Row-Level Security for Multi-Tenant Apps: A Guide
A production pattern for multi-tenant isolation in Supabase — one organization_id column, security-definer helpers, policies that combine tenant and role, triggers that fill the tenant, and tests that prove it.
Help Desk SLA Tracking: Targets, Timers and Breaches
How to set SLA targets an internal help desk can actually meet, measure first response and resolution correctly, and catch breaches before they happen.
Build a Kanban Board in React with dnd-kit (and Postgres)
A production kanban board with dnd-kit — sensors for mouse, touch and keyboard, sortable columns, fractional positions stored in Postgres, optimistic moves that roll back, and accessibility built in.
Help Desk Metrics That Matter (and the SQL Behind Them)
Seven help desk metrics that drive decisions — first response, resolution, SLA attainment, backlog age, reopen rate, reassignments and deflection — with definitions, pitfalls and the queries to compute them.
An Analytics Dashboard with Plain Postgres (No BI Tool)
Build an in-app analytics dashboard from SQL functions — KPIs, breakdowns, time series and percentiles — that respect row-level security, stay fast with the right indexes, and render with Recharts.
Row-Level Security vs App-Layer Authorization: Which Wins?
App-layer checks have to be remembered on every route; row-level security is enforced on every query. When each is right, how to combine them, and the performance and testing details that make RLS work in production.
Rate Limiting API Routes Without Redis (Using Postgres)
A per-user rate limiter built in Postgres — a hits table, a sliding window, an advisory lock against races, and a cleanup job — plus per-IP limits for login, and when you really do need Redis.
Enforcing a Freemium Plan Gate in the Database
Why freemium limits — seats, usage meters, Pro-only features — belong in Postgres triggers and functions, how to stop users upgrading themselves, and the race condition that a count-then-insert check hides.