Supabase Backend

Supabase is "Firebase but Postgres." Best fit: small teams, prototype-to-prod path, want auth+DB+storage+realtime in one bill. Trade-off: row-level security is your security model — get it wrong and your whole DB is exposed.

When to use

• New app, want managed Postgres + auth + storage + realtime in one provider.
• Frontend-heavy apps (Next.js, Expo) where direct DB access from the client is desirable.
• Replacing Firebase for relational use cases.

When NOT to use

• You need fine-grained server-side control of every query → use plain Postgres + your own API.
• Stateless services on Cloudflare/Vercel only — Supabase is overkill.
• Latency-sensitive at scale — Supabase RPC adds ~50ms over direct Postgres.

The mental model: RLS is your security

In Supabase, your client (browser/mobile) gets a JWT and queries Postgres directly via PostgREST. The only thing protecting your data is row-level security. No RLS = full DB exposed to anyone with your anon key (which is in your client bundle).