Supabase: Why We Reach for It Before Anything Else
Supabase is what we use when a product needs a database, authentication, and file storage, which is most products.
What you get out of the box:
- Managed PostgreSQL with a sensible schema editor
- Built-in authentication: email/password, magic links, OAuth (Google, GitHub, etc.)
- Row-level security (RLS), security rules written once in the database
- Realtime subscriptions for live-updating UIs
- File storage with access controls
- Auto-generated REST and GraphQL APIs from your schema
- Edge functions for server-side logic
For an MVP, this means we're writing product logic from Day 1 instead of configuring infrastructure.
The Row-Level Security advantage
RLS is the feature that makes Supabase genuinely different from just "managed Postgres." You write security rules directly in the database, rules like "users can only see rows where user_id matches their authenticated ID." These rules apply at the database level, regardless of how your API is written.
This eliminates a whole category of security bugs that come from forgetting to add auth checks in individual API routes. For a 15-day build, one fewer category of security bugs is significant.
The free tier is genuinely useful
Supabase's free tier supports up to 500MB database, 1GB file storage, and 50,000 monthly active users. For an MVP, this is real headroom. You can validate product-market fit entirely on the free tier.
When we don't use Supabase
When a client has existing infrastructure they need to integrate with (their own Postgres, existing auth system, existing file storage). We don't rip out working infrastructure to standardize on our preferred stack. We work with what's there.
Also for AI-heavy workloads where we need dedicated vector storage. Supabase has pgvector support, but for serious RAG applications we evaluate Pinecone or Weaviate separately.