EngineeringScoreSupabase
Supabase is the Postgres under EngineeringScore. Scan runs, reports and the articles this site serves all sit in one Supabase project.
We recommend it because we run it
Both halves of this product read the same Supabase project, and they reach it two different ways. The API treats it as ordinary Postgres over a session-mode pooler connection with Drizzle on top, while this frontend uses the Supabase JavaScript client for one job only, reading published articles with the anonymous key.
What would show you that
- The API's package.json lists drizzle-orm and pg and carries no Supabase SDK at all, and its drizzle.config.ts hands drizzle-kit a plain DATABASE_URL. That is why the swap-out argument below is a real option rather than a comforting one.
- In this repository, src/lib/server/supabase.ts is the only file that constructs a Supabase client, and docs/deploy-container.md lists PUBLIC_SUPABASE_URL and PUBLIC_SUPABASE_ANON_KEY among the variables a deploy is broken without.
What it doesn't do
- Supabase's row-level security guide says RLS is on by default only for tables made in the dashboard's table editor, and that a table created in raw SQL has to have it switched on by hand. Every table behind this product came out of a migration, which is raw SQL, so that default is not what protects us.
- Supabase documents its direct endpoint as IPv6, reachable over IPv4 only with the IPv4 add-on, and warns that the add-on is not dual-stack: switching it on swaps the project's AAAA record for an A record. Its dedicated pooler is likewise a paid-plan feature.
- Using Supabase as plain Postgres, which is what our API does, leaves its auth, storage and realtime layers out of play entirely. Most of what is written about Supabase is about those, and none of it tells you how this part behaves.
- Transaction-mode pooling does not support prepared statements, per Supabase's own connection docs, so the pooling mode you pick is a constraint on your client library and not a slider you can move later without checking.
What it does
- Supabase hands you a Postgres connection string, so anything that speaks Postgres works against it with no client library in the way. That is the property we actually depend on, and it is why the migrations behind this site are ordinary SQL files.
- Supabase's connection docs set out direct, session-pooled and transaction-pooled endpoints and say which belongs where: a persistent backend on an IPv4-only network wants session mode, a serverless function wants transaction mode.
- The Data API together with row-level security is what lets a key that ships to a browser read only what a policy allows, which is how this site serves its article pages with no service-role secret anywhere in the frontend.
Nothing here is gated behind us. Go straight to Supabase and make your own mind up.
Sources
Every claim about Supabase on this page was read on from the pages below. Products change and this page does not change with them, so treat the date as the claim's expiry rather than its publication.
- Supabase's connection documentation: the direct, session-pooled and transaction-pooled endpoints and what each is for, that the direct endpoint is IPv6 unless the IPv4 add-on is enabled, that the add-on is not dual-stack, that the dedicated pooler is a paid-plan feature, and that transaction mode does not support prepared statements
- Supabase's row-level security guide: that RLS must be enabled on any table in an exposed schema, and that it is on by default only for tables created through the dashboard's table editor
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.