SysPad › Lessons › database lessons › Supabase
How Supabase works
Managed Postgres + Auth + Realtime ("open-source Firebase"). Plan-priced: the ceiling is the Postgres compute behind your plan, not a per-op meter. Free tier pauses after inactivity.
"Firebase, but it is just Postgres" is the whole pitch, and it lands. Supabase gives you auth, realtime, storage AND a genuine SQL database you can join, index, and eventually take anywhere. The mental model shift from Firebase: your limits stop being a per-operation meter and become one Postgres box.
What you will learn
- What does "open-source Firebase on Postgres" buy you concretely?
- Why is the ceiling a compute tier instead of an operations meter?
- What is row level security and why is it load-bearing?
- What bites free-tier projects (hint: they sleep)?
Postgres with batteries
A Supabase project is a real Postgres database wrapped with auto-generated REST/realtime APIs, auth, and file storage. Because the core is standard Postgres you get joins, transactions, SQL, and a credible exit path (pg_dump) that document stores cannot offer.
Plan pricing = instance ceiling
You pay a plan plus a compute add-on: effectively renting a Postgres instance size. Throughput saturates like Postgres does (connections, CPU, slow queries), and the fix is the classic ladder: indexes, connection pooling, read patterns, THEN a bigger tier.
Row level security is the auth model
Supabase clients talk to the database directly from the browser. What stops users reading each other's rows is row level security: policies in Postgres like "users see rows where user_id = auth.uid()". RLS is not optional hardening, it IS the security boundary.
⚓ The recurring incident report: a table created without RLS enabled, fully readable by anyone with the public anon key. Enable RLS on day one, on every table.
Why does the free tier pause my project?
Free projects run on shared micro compute and are paused after about a week without activity; the first request after that eats a resume delay. Fine for demos and side projects, and precisely the behavior you disable by paying, the same trade Neon makes with scale-to-zero.
Flashcards
- Your Firestore-trained teammate asks "how much do 10M Supabase reads cost?" What is wrong with the question?
- Supabase has no per-operation meter: you rent Postgres compute at a flat monthly rate. The right questions are "does the tier's CPU handle our QPS" and "are the queries indexed."
- A pentest pulls every user's profile through your Supabase anon key. The API code looks fine. Where is the hole?
- A table without row level security: clients query Postgres directly, so RLS policies are the actual authorization layer. "Fine API code" cannot compensate for a policy that does not exist.
- The demo you built last month "takes 10 seconds to load, then it is fast." What happened?
- Free-tier project was paused for inactivity; the first request paid the resume. Expected on free; a paid plan (or a keep-alive ping, in spirit-violating fashion) removes it.
Sources
Open the SysPad canvas · Official Supabase documentation