Free tools Windows power users keep installed
One-click scans. No signup required.
A working prototype is not production-ready until its data access is constrained, database changes are repeatable, recovery has been tested, and someone can see and respond to failures. For a Supabase app, start by checking table-level grants and row-level security (RLS), then move secrets off the client, establish a migration workflow, and validate recovery, load, and monitoring against your own requirements.
Is every exposed table protected by RLS?
Begin with an inventory of tables in exposed schemas. For each table, write down which app roles need which operations—select, insert, update, or delete—and what records each role may touch. A table in an exposed schema without RLS can be accessed according to its SQL grants. Enabling RLS alone is not enough: broad grants can remain, and policies do not remove them.
As an Amazon Associate I earn from qualifying purchases.
Match grants and policies to actual app behavior
- Enable RLS on every table in an exposed schema that the application can reach.
- Reduce SQL grants so each role has only the table operations it requires. Do not assume a policy revokes a grant.
- Write policies per operation, expressing which rows a role may read or change. Avoid treating one permissive policy as proof that every operation is safe.
- Test both allowed and denied cases for select, insert, update, and delete as
anonandauthenticated. Include realistic identities, records belonging to other users, missing or unexpected fields, and attempts to change ownership or access-related values. - Run the database tests with
supabase test db, and keep the tests with the schema so they can be rerun after changes.
A useful test does not merely show that a legitimate user can read their own record. It also asserts that an anonymous request cannot read it, another signed-in user cannot read or alter it, and a user cannot create or update a record that violates the intended ownership rules.
Which keys belong in the browser, and which must stay private?
A publishable key identifies the project; it is not an authorization rule. A frontend can use one only when the exposed data is protected by appropriately narrow grants and RLS policies. Older projects may show an anon key rather than a publishable key; Supabase says to treat that key as publishable, not secret, while still relying on RLS and least-privilege grants.
#1 Best Overall
Never put a secret key or service-role key in browser code, a mobile app bundle, or a public repository. These privileged keys bypass RLS. Keep them in backend environment variables or another server-side secret store, and use them only in trusted server-side logic.
Choose the access route deliberately
| Route | When it fits | Security boundary to verify |
|---|---|---|
| Frontend through the Data API | The client needs direct access to data under user-scoped rules. | Publishable key, limited SQL grants, and tested RLS policies; never privileged keys. |
| Server-side Edge Function logic | A request needs trusted server-side logic or access that should not be granted directly to a client. | Keep secrets on the server and validate what the caller is allowed to request. |
| Trusted direct database connection | A trusted backend needs database connectivity rather than client-facing Data API access. | Use a trusted server-side environment and a security model appropriate to that connection; do not expose credentials to clients. |
These routes have different security models; none makes application authorization automatic. Supabase’s shared-responsibility guidance places access levels, sensitive-table permissions, secrets, and application architecture with the customer.
Rank #2
Review the account and transport controls too
- Require multi-factor authentication for relevant accounts and review who has organization access.
- Review SSL enforcement and database network restrictions for the project and its deployment environment.
- Check email-confirmation and authentication settings against the account-verification flow your app expects.
Supabase’s production checklist covers these project controls, but the right configuration depends on how the app authenticates and where its trusted services run.
How will schema changes reach production?
Replace one-off edits to the live database with version-controlled migrations. Supabase’s maturity guidance recommends migrations and multiple environments, and advises against changing a live production database through the Dashboard. A prototype can tolerate improvised changes; a production schema needs a record that another developer or deployment can reproduce.
Use a reviewed path from local work to production
- Make the change in development and capture it as a migration in version control, rather than relying on an undocumented manual edit.
- Review the migration for its effect on existing data, permissions, policies, indexes, and application code.
- Apply and validate it in staging using representative data and the same migration path intended for production. Test the app and database policies against the changed schema.
- Deploy through a controlled production path after review. Keep a rollback or forward-fix plan appropriate to the change and its data effects.
- Record what was applied so the team can establish which schema version is running in each environment.
Maintain separate local, staging, and production environments so a migration can be exercised before it reaches user data. Supabase’s production checklist recommends connecting GitHub and automating deployment from a production branch; preview branches can help test migrations where available. A repository connection or automated deployment does not itself make an unsafe migration safe—the review and staging validation still matter.
What happens if production data needs restoring?
Decide how much data loss is acceptable and how quickly service must return before choosing a recovery approach. A recovery point objective (RPO) is the amount of recent data the business can afford to lose; a recovery time objective (RTO) is how long restoration can take. The right backup plan depends on those objectives, the applicable plan and retention, and what data the application stores outside the database.
| Recovery mechanism or data | What Supabase documents | Decision to make |
|---|---|---|
| Daily database backups | Supabase manages daily database backups. | Confirm the applicable plan and retention, and whether the recovery point meets your RPO. |
| Point-in-time recovery (PITR) | Available on paid plans. | Check plan availability and whether the finer recovery capability is needed for your RPO and RTO. |
| Files stored through the Storage API | Not included in database backups. | Plan protection and restoration for stored objects separately from database recovery. |
Supabase’s production checklist recommends considering PITR when the database is expected to exceed 4 GB. That is a product-specific trigger to consider, not a substitute for setting recovery objectives; a smaller database can still have strict recovery needs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Prove the restore path
- Identify who can initiate recovery and where the necessary credentials and instructions are kept.
- Restore into a non-production environment and check that the app can use the restored database.
- Verify object-storage recovery separately, including whether restored database records still point to available files.
- Measure how long the process takes and whether the recovered data is recent enough for the business.
Also verify the service expectations of the chosen plan. Supabase’s production checklist says Free Plan projects with low activity over a seven-day period may be paused; confirm current plan behavior if uninterrupted availability is required.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can the app handle expected load and abuse?
There is no universal production capacity number that can be inferred from the fact that a prototype works. Capacity depends on the project’s compute, disk, connections, query patterns, and actual launch traffic. Use your expected workload and observed staging behavior to guide decisions rather than guessing at a tier.
Measure likely workloads before launch
- Review Supabase’s Performance Advisor and Security Advisor and resolve findings that apply to the app.
- Inspect slow queries and index common query patterns; add indexes based on the queries and data distribution you actually expect.
- Load test in staging with representative data and realistic request patterns. Supabase names k6 as one possible load-testing tool.
- Check resource use, connection behavior, disk needs, and query latency under expected traffic and plausible spikes.
Make abuse controls fit the authentication flow
Review authentication rate limits, CAPTCHA or bot protection, and transactional email setup. Supabase’s limits and defaults can change, so check the live project settings and current documentation rather than copying a rate-limit value from an old guide.
Supabase’s production checklist recommends a maximum OTP expiry of 3,600 seconds (one hour) or lower. Treat that as a checklist recommendation, not a universally suitable setting: verify the current setting and choose an expiry that fits the app’s security and user experience requirements.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How will you know when production is unhealthy?
Monitoring needs to cover both user-visible failures and the resources that can cause them. Supabase’s observability guidance describes Logs, database inspection and statistics, the Metrics API, advisors, and dashboards spanning API, Auth, Storage, Realtime, and database signals.
Set up an operating loop
- Decide what should page or alert. Choose useful signals for errors, latency, and capacity rather than collecting metrics no one will act on.
- Assign an owner. Make clear who responds, how they investigate, and who can make an operational change.
- Watch authorization failures as well as availability. A rise in denied requests can indicate a policy regression, a broken client flow, or an attempted misuse—not just an uptime problem.
- Use logs and statistics to diagnose. Correlate application symptoms with API, Auth, Storage, Realtime, and database signals where relevant.
- Review advisors, metrics, and reports regularly. Revisit security, performance, health, and resource findings as usage and schema change.
A launch checklist is a starting point, not a permanent certification. Recheck policy tests, migration discipline, restore procedures, load assumptions, and alerts when the app’s data model, traffic, or team changes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
