Supabase is an open-source alternative to Firebase

Awesome Supabase

A curated list of awesome things related to Supabase.

Supabase is an open source alternative to firebase helping in the process of developing a customizable backend for your application. You can start a project with a database, authentication and other things quickly.

Contents

• SDKs
• Postgrest
• Realtime
• GoTrue
• UI Components
• Projects Using Supabase

SDKs

• supabase-js - Supabase official SDK for JavaScript/Typescript.
• supabase-py - Supabase official SDK for Python.
• supabase-dart - Supabase SDK for Dart (Flutter) (community).
• supabase-csharp - Supabase SDK for C# (community).

Postgrest

• postgrest-kt - Postgrest library for Kotlin.
• postgrest-dart - Postgrest library for Dart.
• postgrest-csharp - Postgrest library for C#.
• postgrest-py - Postgrest library for Python.
• postgrest-rs - Postgrest library for Rust.
• postgrest-swift - Postgrest library for Swift.
• postgrest-js - Postgrest library for JavaScript.

Realtime

• realtime-csharp - Realtime library for C#.
• reatime-dart - Realtime library for Dart.
• realtime-js - Realtime library for JavaScript.
• realtime-py - Realtime library for Python.

GoTrue

• gotrue-csharp - GoTrue for C#.
• gotrue-js - GoTrue for JavaScript.
• gotrue-dart - GoTrue for Dart.
• gotrue-java - GoTrue for Java.
• gotrue-kt - GoTrue for Kotlin.

UI Components

• next-server-components - Next Server Components.
• refine - A React-based framework for building data-intensive applications in no time.

Blogs

• Introduction to supabase and Auth
• Fix "new row violates row-level security policy" in Supabase - Troubleshooting guide for INSERT/UPDATE failures caused by missing or failing WITH CHECK policies.
• Supabase service_role key: safe usage and exposure checklist - Checklist for keeping the service_role key off the client and rotating it after exposure.
• Supabase anon key exposed: safe or dangerous? - Explains when a public anon key is expected and when missing RLS makes it dangerous.
• Supabase MCP safe setup for Cursor and Claude Code - Guardrails for connecting AI coding tools to Supabase without leaking secret keys.
• Supabase Oct 30 grants change: fix 42501 on new tables - Why new public tables return permission denied (42501) after Oct 30, 2026 even with RLS on, and the GRANT SQL to fix it.
• Supabase growth teardown: 111,751 stars and 19.9M weekly downloads, what the numbers actually measure - Evidence-cited analysis of Supabase's growth metrics with sources marked as fact, inference or opinion.
• Security checklist for Lovable, Bolt and Cursor apps - Eight checks to run before real users join an app built with Lovable, Bolt or Cursor on Supabase: RLS, keys, storage, ownership checks and secrets.

Tools and Extensions

• GuardLayer - Free static security scanner for Next.js + Supabase apps; flags exposed keys, missing/disabled RLS, over-permissive policies, and unprotected routes on every push, with the exact fix.

• backupdrill - Back up the database and Storage files to your own bucket, with scheduled restore-verification drills (MIT CLI).

• Bible School LMS - Free, open-source LMS built on Supabase (Auth, Database with RLS, Storage). Designed for Bible schools and nonprofits.

• Edge Worker - Library that Supercharges Background Tasks and Supabase Queues

• MailKite SaaS Starter - Open-source Next.js 15 SaaS starter kit with self-contained auth (Google/GitHub OAuth + email/password), Stripe subscriptions, teams, and Postgres on Supabase (Drizzle ORM).

• supabase-plus - An extra set of tools for managing Supabase projects, going beyond the possibilities of the regular Supabase CLI.

• Nemesis Shield - Wrap a Supabase Edge Function in a positive-security WAF with one line (withShield from jsr:@nemesis-shield/edge); it learns each function's normal requests and blocks the rest. Open-source SDKs (MIT), free tier.

• supabase-rls-leak-demo - Minimal reproducible Supabase/Postgres RLS isolation failure that runs entirely in PGlite (no cloud project or credentials), plus a free read-only audit SQL that flags RLS-disabled tables, permissive USING(true) policies, and cross-tenant read/write leaks (MIT).

• 1bench - Paid desktop client for Supabase Postgres with pgvector support.

• HTMLRadar - Open-source DocSend for HTML: turn an HTML file into a tracked share link with per-viewer read analytics. Next.js + Cloudflare Workers + Supabase.

• RowShield - Checks a deployed Supabase app from the outside for tables and storage that anonymous callers can read, with a free read-only probe; paid plans add scheduled RLS policy and drift checks.

• Ekwo OS - Open-source double-entry accounting core as Postgres migrations: RLS on every table, versioned country packs, import of existing books, a CLI installer and an MCP server (AGPL-3.0; format libraries MIT).

• supabase-security - Lints supabase/migrations with no credentials for the Oct 30, 2026 Data API grants change: tables and views with no GRANT, grants to anon on tables with RLS off, blanket on all tables grants, SECURITY DEFINER functions callable through PUBLIC. Proposes least-privilege grants that mirror your policies; CLI and GitHub Action (MIT).

• Supabase RLS self-audit - Two read-only SQL queries for the SQL Editor. The RLS audit flags tables with RLS off, USING (true) policies, policies not tied to the caller, views without security_invoker, API-callable SECURITY DEFINER functions and open storage policies, with the fix for each. The grant check covers the Oct 30, 2026 Data API grants change: whether new tables are still auto-granted, tables service_role or authenticated cannot reach (with the grant to add), and reachable tables with RLS off (MIT).

• AltoRank - Open-source SEO content software built on Next.js + Supabase: readiness checks, keyword research and drafts into a review queue, with a hosted MCP server (AGPL-3.0).

• looot-tables - Open-source Clay alternative for developers: enrichment tables on Supabase Postgres and Next.js (MIT). Import a CSV, add a column that runs a looot data API call (work email, company data, Google results), see the cost before it runs. Needs a looot API key; no demo mode.

• FixLoop Supabase grants checker - Free browser tool for the Oct 30, 2026 Data API grants change. Paste migrations to find new public tables with no GRANT (they return 42501 even with RLS on) and copy least-privilege GRANT statements. SQL stays in the browser, no signup.

• Next.js Supabase Stripe Security Checker - Free CLI and GitHub Action that scans Next.js + Supabase + Stripe repos for common mistakes: service-role keys in client code, tables without RLS, write policies with using (true) and unsafe Stripe webhooks; 24 checks, runs locally (MIT).

• RLS Radar - Free, read-only check of a deployed Supabase app from the outside: detects keys shipped in the frontend bundle, flags exposed service_role/secret keys, and lists tables and storage buckets that answer to the anon key (counts only, no rows stored). Requires an ownership confirmation.

• SupaBaseFolder - macOS menu bar app that mirrors every table into a folder as live .xlsx/.json files and syncs edits both ways over Realtime, with an offline queue, bulk-delete confirmation and a restore log (MIT).

• instancez - Backend for Developers and Agents - single-binary, runs anywhere.

• supabase-email59-send-hook - Send Email Hook as an Edge Function: sends sign-up, magic link, password reset, invite and email change emails through the email59 API, with no SMTP or domain setup; checks the hook signature and has no dependencies (MIT).

• VibeRaven - Open-source CLI that checks AI-built Supabase + Vercel apps for launch gaps before you ship: tables without RLS, USING (true) policies, service_role keys in client code, SECURITY DEFINER functions the anon key can call. Reads your repo and migrations locally with npx -y viberaven check; a repo check, not a live database test (MIT).

• validra-check - Fast, read-only CLI scanner to find exposed Supabase tables, missing RLS policies, and leaked secret keys in web apps.

If you want to add you project here, please create a pull request for it