Supabase for Everything: Why It's My Go-To Backend

16,000 Supabase databases were just found wide open. I still use it for everything.

Late last month, the security firm UpGuard published research showing 16,326 Supabase databases with tables anyone on the internet could read. They scanned about 300,000 domains that showed signs of running on Supabase, and over half of the exposed databases had personal info in them: names, addresses, phone numbers. A smaller set leaked passwords and auth tokens. TechCrunch and BleepingComputer picked it up the same week.

Supabase is the backend I build almost everything on, including TaskLine and the custom portals I build for clients. So I want to do two things in this post: explain why I still pick it, and explain the one setting behind most of those leaks, in plain English, so you know what to ask whoever builds your software.

Why a plumber or property manager should care about a database story

Because the data in these apps is your customer list. One of UpGuard's examples was a US valet service with more than 100,000 customer records and 665 staff records sitting readable on the open web. Swap "valet" for "HVAC company" or "cleaning service" and it's the exact data a client portal or job app holds: who your customers are, where they live, how to reach them.

And more of that data is getting wired into new tools every month. Housecall Pro's 2026 survey found 48% of home service pros already use AI in their business (53% of plumbers, 54% of electricians). Homebase found 74% of small businesses are using or piloting AI, and the number one worry, at 51%, is data privacy. That worry is reasonable. The UpGuard research is what it looks like when nobody checks.

What Supabase actually is

Supabase is a hosted Postgres database with the stuff every app needs bolted on: user logins (auth), file storage, real-time updates, and edge functions for small bits of server code like webhooks. It's not a niche tool anymore. In June it raised $500 million at a $10.5 billion valuation and says more than 9 million developers use it.

The pricing is a big reason it works for small businesses. Per Supabase's pricing page, the free plan gives you a 500 MB database but pauses after a week of inactivity, which is fine for prototypes and not fine for a business. The Pro plan starts at $25/month, never pauses, and includes daily backups. Team starts at $599/month if you need SOC 2 paperwork. For a 10-person service company, Pro is usually all you need.

Why it's my go-to backend

Row level security, for real multi-tenant apps

Most of what I build has the same shape: one database, lots of people who should only see their own slice. Customers see their own jobs and invoices. Techs see their own schedule. The owner sees everything. Postgres row level security (RLS) lets me write those rules once, inside the database, instead of hoping every screen in the app remembers to filter correctly. If a bug in the front end asks for the wrong rows, the database says no.

Real-time without extra plumbing

In TaskLine, when a client sends a message or a payment comes in, the dashboard updates instantly through Supabase's real-time subscriptions. No polling, no separate websocket server to babysit.

Your history becomes the AI's context

TaskLine stores approved proposals in Supabase and uses them as context when it drafts the next one, which is how the AI ends up writing in the owner's voice with their pricing patterns. Because it's just Postgres, that data is also there for normal reporting: revenue by month, quotes that never closed, all with plain SQL.

Why not Firebase or raw Postgres?

Firebase is a solid product, but for jobs, customers, invoices and line items I want real relational tables and SQL, not documents I have to stitch together. Raw Postgres on a server gives me the tables but makes me build auth, storage, backups and an API myself. Supabase sits in the middle, and if a client ever wants to leave, it's a standard Postgres database they can take with them.

So what went wrong for those 16,000?

Here's the part that matters. Supabase exposes your tables through an API, and the key the browser uses to call it is public on purpose. The thing that protects your data is RLS. Supabase's own docs are blunt about it: "A table in an exposed schema without RLS is readable and writable by any role with a grant on it."

UpGuard found that RLS is switched on by default for tables created in Supabase's Table Editor, but tables created through the API, which is how AI coding agents tend to create them, don't get it by default. Add policies that look restrictive but aren't, plus secret keys pasted into front-end code, and you get the list. BleepingComputer noted the common thread was apps built by AI coding agents whose owners didn't know the setting existed, though UpGuard was clear its scan can't prove that for every site.

Supabase's CISO told TechCrunch that projects are "secure by default" and that security is a shared responsibility. Both things can be true. The platform gives you the lock. Someone still has to turn it.

What's real and what's hype

Real: AI tools can build a working app on Supabase in an afternoon. I use Claude for a lot of my own build work. Hype: that "working" means "safe to put customer data in." An app that loads the right screens can still hand every row in the database to anyone who opens the browser console.

The checklist I run on every project

• RLS on every table, no exceptions. alter table jobs enable row level security; is the first line after any create table.
• Policies tied to the logged-in user. Something like using ( (select auth.uid()) = owner_id ), so a customer only ever gets their own rows. No using ( true ) on anything with personal data.
• Secret keys stay on the server. The docs say it straight: never put a secret key in the browser. Mine live in edge functions and server routes only.
• Test as a stranger. Before launch I hit the API with the public key and no login. If anything comes back from a customer table, it doesn't ship.
• Limit what AI tools can touch. As of October 6, Supabase supports scoped access tokens that can be locked to one project and read-only access, including for its MCP server. If an AI assistant is helping build or query your app, it gets the smallest key that works.

Where Solvr Labs fits

This is exactly the work behind my custom software service. When I build a client portal, an owner dashboard, or a full job management platform for a service business, it runs on Next.js, Supabase and the Claude API, with RLS set up before a single real customer record goes in.

• You own it. 100% of the code and data, hosted on your own Vercel and Supabase accounts. If we stop working together, you keep everything.
• It's sized for a small business. A focused app usually takes 4 to 6 weeks, and a Supabase Pro plan for a small company starts at $25/month, versus stacking another per-seat SaaS subscription. (Worth noting: 41% of small business owners told Small Business Expo their software costs went up this past year.)
• It works with what you already use. Stripe for payments, Twilio for texts, Google for calendar, and Radar if you want calls answered and jobs booked automatically.
• Or skip the build. If you just need proposals, jobs, invoicing and follow-ups, TaskLine already does that on the same stack, and TaskLine users get the Radar setup fee waived.

What to do this week

If someone (or some AI) built an app for your business that stores customer info, ask them three questions:

• Is row level security turned on for every table with customer data?
• What can someone see with the public key and no login? Have you actually tested it?
• Where does the secret key live? (The right answer is "only on the server.")

If you get a blank stare, that's your answer. And if you're not sure what you even have, book a free operations assessment. It's 30 minutes, you get a written report, and we can go through what you're running and where your customer data actually lives.

Sources

• Everything Everywhere: Systemic Data Exposure in Supabase Apps, UpGuard, Oct 2026
• Some Supabase customers are publicly exposing reams of people's data to the web, TechCrunch, Sep 25, 2026
• Over 16,000 Supabase databases expose PII, passwords, auth tokens, BleepingComputer, Sep 28, 2026
• Row Level Security, Supabase Docs
• Pricing, Supabase
• Changelog: scoped personal access tokens, Supabase, Oct 6, 2026
• Supabase Raises $500 Million at $10.5 Billion Valuation, Orrick, Jun 8, 2026
• AI in the Trades, Housecall Pro, Jun 2026
• 2026 Main Street AI Gap Report, Homebase, Sep 22, 2026
• 41% Of Small Business Owners Report Rising Software Costs, Small Business Expo, Mar 2026