Supabase Guides: Auth, RLS and pgvector
Building on Supabase's free tier: server-side auth in Next.js, multi-tenant row-level security, pg_cron and pgvector.
9 articles
Scheduled Jobs in Supabase with pg_cron: A Practical Guide
How to run scheduled jobs inside Postgres on Supabase with pg_cron — idempotent schedules in migrations, catch-up logic, locking down job functions, outbound HTTP with pg_net, monitoring runs, and the free-tier pause.
Supabase Security Definer Functions: The Hidden Exposure
In Supabase, public-schema functions are callable over the API — and SECURITY DEFINER ones bypass row-level security. What our audit found in 117 such functions, the real damage paths, and the grants and rules that close them.
How to Build an Internal Help Desk with Next.js and Supabase
The architecture behind a production internal request desk — Postgres row-level security for tenancy, SLA timers the database computes, and AI that helps but never blocks — on free tiers.
Supabase Row-Level Security for Multi-Tenant Apps: A Guide
A production pattern for multi-tenant isolation in Supabase — one organization_id column, security-definer helpers, policies that combine tenant and role, triggers that fill the tenant, and tests that prove it.
Semantic Search for a Knowledge Base with Supabase pgvector
Build semantic search over a help desk knowledge base with Supabase and pgvector — embeddings, an HNSW index, a similarity threshold, hybrid keyword search, and the multi-tenant security mistake to avoid.
Next.js App Router + Supabase Auth: The SSR Setup That Works
Two clients, a proxy that refreshes the session, getClaims or getUser instead of getSession, and a layout gate — the Supabase SSR auth setup for the Next.js App Router, with the mistakes that cause random logouts and leaks.
SaaS on Free Tiers: An Architecture That Actually Holds
How to run a real SaaS on free tiers — Supabase, free AI APIs, free email — with the actual limits, what breaks first, the commercial-use rules people miss, and the design choices that keep it inside the budget.
An Analytics Dashboard with Plain Postgres (No BI Tool)
Build an in-app analytics dashboard from SQL functions — KPIs, breakdowns, time series and percentiles — that respect row-level security, stay fast with the right indexes, and render with Recharts.
Row-Level Security vs App-Layer Authorization: Which Wins?
App-layer checks have to be remembered on every route; row-level security is enforced on every query. When each is right, how to combine them, and the performance and testing details that make RLS work in production.