Supabase Developer & Fix Expert

Supabase is the default Postgres backend for apps scaffolded by Lovable, Bolt, v0, Cursor, and Claude Code. The tools generate a schema, wire the client, and produce something that runs in a preview. None of that work is wrong per se, but almost all of it is incomplete. A Supabase developer for fixes spends most of their time on the five surfaces the code generator skips: row level security, key management, auth configuration, realtime permissions, and migration discipline.

The pattern is consistent across the roughly 40 Supabase rescues we have run in the past year. The scaffolded code speaks SQL, but it does not speak production. Tables are created with RLS off. Service role keys make their way into React components. Auth callbacks point at localhost. Realtime channels subscribe without cleanup and leak rows across users. Edge functions get called on every render. The app looks finished and the founder ships it to paying customers. Then an ordinary bug tips over into a data exposure, and the rescue call lands in our inbox.

AI coding tools are optimizing for a demo that works, not a backend that survives. A Supabase developer for fixes tightens the parts the generator never saw — policies that encode who can see what, keys that stay on the right side of the network, and a migrations directory that lets you replay the schema into a new environment without guesswork.

A Supabase auth fix usually comes down to three gaps. First, OAuth callbacks point at localhost after deploy because the AI tool configured the client redirect but never updated Supabase Site URL or the Google Cloud authorized redirect URIs. Second, session refresh silently fails because the generated client never enables persistSession or handles the TOKEN_REFRESHED event. Third, multi-factor auth, which Supabase supports, is almost never scaffolded because the code generator treats it as optional.

We test a full sign-up, sign-in, sign-out, password reset, and refresh sequence against a staging project before marking auth as fixed. We also add a regression test for the token refresh path, because it is the auth failure that shows up two weeks later when tokens start expiring in production. Our auth specialist covers the same territory for apps built on Clerk or Auth.js.

The other common finding is a broken email flow. Lovable defaults to the built-in Supabase SMTP, which is unauthenticated and lands in spam. Swap in Resend, Postmark, or SendGrid, verify DKIM, SPF, and DMARC, and confirm the password reset email lands in a fresh inbox before closing the ticket.

A Supabase edge functions fix usually starts with a single question: why is the service role key in the browser? The honest answer, most of the time, is that the AI tool copied the Supabase docs example verbatim and pasted it into a client component. The service role key bypasses RLS. If it lands in a React file, every visitor has database-admin rights. We rotate the key, relocate the query, and audit the build output to confirm nothing leaked.

Edge functions are the right home for privileged database work. We wrap the operation in a Supabase edge function, authenticate the caller, validate input, and return a minimal payload. For anything that needs to persist across requests — Stripe webhooks, cron work, background jobs — we reach for a dedicated queue rather than relying on the edge runtime. See our Stripe integration developer hub for the webhook patterns that pair with edge functions.

A common anti-pattern is an edge function that reinvokes a chatty Supabase client on every call. The function spins up, connects, runs one query, and returns, which doubles the latency the client would have seen. We consolidate reads into a single query, cache where safe, and set sensible timeouts. Most edge function bills we rescue drop by 60% after the first audit.

// app/components/AdminPanel.tsx
'use client';
import { createClient } from '@supabase/supabase-js';

const supabase = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.NEXT_PUBLIC_SERVICE_ROLE_KEY! // leaks to bundle
);

export function AdminPanel() {
  // any visitor has DB admin rights
  const run = () => supabase.from('users').delete().neq('id', '0');
  return <button onClick={run}>Purge</button>;
}

// app/api/admin/purge/route.ts (server only)
import { createClient } from '@supabase/supabase-js';

export async function POST(req: Request) {
  const auth = req.headers.get('authorization');
  if (!isAdmin(auth)) return new Response('forbidden', { status: 403 });

  const admin = createClient(
    process.env.SUPABASE_URL!,
    process.env.SUPABASE_SERVICE_ROLE_KEY! // server env, no NEXT_PUBLIC
  );
  await admin.from('users').delete().neq('id', '0');
  return new Response('ok');
}