# Devverse Supabase Auth

> Supabase auth, favorites, and security boundaries for DevVerse. Use when changing files under supabase/, auth or favorites UI, or the verify-email and reset-password API routes.

- Skill: `hoangsonww/devverse-supabase-auth` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add hoangsonww/devverse-supabase-auth`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hoangsonww/devverse-supabase-auth/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: hoangsonww (https://skillmd.com/u/hoangsonww)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hoangsonww/devverse-supabase-auth

---


# DevVerse Supabase Workflow

1. Keep anon and service-role responsibilities separate.
Browser-facing auth, favorites, and storage helpers use the anon client. Service-role usage must stay server-only.

2. Treat verify-email and reset-password routes as security-sensitive.
Those routes are publicly callable and currently enumerate users via `listUsers({ perPage: 1000 })`.

3. Do not move service-role code into shared modules imported by client code.

4. Remember what Supabase is and is not used for here.
Supabase handles auth, favorites, and some profile/storage helpers. It is not the runtime source of article content.

5. Read the runtime boundaries before changing auth or favorites behavior.
@references/runtime-boundaries.md

6. After auth route changes, run repo tests and state any real-env validation you could not perform.