2.3.2 Supabase Skills
When using Supabase as the backend/BaaS, enforce these database, security, and performance rules strictly.
1. Row Level Security (RLS)
- Deny by Default: All tables must have RLS enabled immediately (
ALTER TABLE X ENABLE ROW LEVEL SECURITY;). - Policy Granularity: Write explicit
SELECT,INSERT,UPDATE, andDELETEpolicies referencingauth.uid(). - Security Definer: Be extremely careful with Edge Functions or DB Functions using
SECURITY DEFINER.
2. Performance & Postgres
- Indexes: Always create indexes on foreign keys and columns frequently used in
WHERE,ORDER BY, orJOINclauses. - View Alternatives: Use materialized views for heavy analytical queries instead of querying raw tables repeatedly.
3. Edge Functions
- TypeScript: Write Edge Functions in TypeScript using Deno.
- Payload Validation: Validate incoming JSON structures securely before passing them to the database.