Database & auth
Supabase
Postgres database with authentication, file storage, realtime, and edge functions, often the default backend under an AI-built app.
Pricing as seen
Free, then Pro from $25/month and Team from $599/month. Compute is billed per project. Pro includes $10/month in compute credits that cover one Micro instance. Enterprise is custom.
Checked 16 Oct 2026. Prices change. Confirm on the vendor site before you buy.
Pricing sourceUpdated
16 Oct 2026
Added
16 Oct 2026
Supported builders
Commonly wired up by Lovable and Bolt, and easy to add from Cursor, Claude Code, Windsurf, v0, or Replit. The integration is a URL and keys, not a guarantee the policies exist.
What it is
Supabase is a hosted Postgres database plus the pieces a generated app usually needs next: email and social auth, file storage, row-level security, and auto-generated APIs. The client uses a publishable anon key. That key is not a password. Access is supposed to be enforced by RLS policies.
You can also self-host. Lovable and Bolt projects often start on Supabase or a similar hosted Postgres. The failure mode we see described across scanners is a table created with RLS off, or a service-role key copied into the frontend.
Best for: An app that needs Postgres, auth, and storage and whose author can look at a policy and tell whether it is too open.
Watch-outs
- Free projects pause after a week of inactivity, and the free plan allows two active projects.
- The anon key is public by design. Security depends on RLS, not on hiding that key.
Our take
Opinion from ShipSafeStack. Not a score, not a certification, and not a sponsorship.
A strong default if you want SQL you can read and a dashboard a non-specialist can open. The product will not stop you from shipping an open table. Budget an hour for the RLS checklist before the URL is shared, and never put the service-role key in client code.