Production checklist
Supabase production checklist: 5 checks before launch
5 checks for running Supabase in production: 2 must-dos, 1 should-do and 2 good-to-haves. Each one says why it matters, how to verify it and where the docs are.
Updated . Every check links the vendor’s own docs.
Must do (2)
Enable Row Level Security on every table
Tables in an exposed schema without RLS can be read and written by anyone holding the public anon key.
Verify with SQL
Run this in the SQL editor. It lists tables in the public schema with Row Level Security off; a pass returns no rows. The Security Advisor (Advisors in the dashboard) flags the same thing.
select tablename from pg_tables where schemaname = 'public' and not rowsecurity;
Keep the service_role key server-side only
It bypasses RLS. Never ship it to the browser, a mobile app or a NEXT_PUBLIC_ variable.
Verify from the command line
Search your code for public environment variables that hold a service role or secret key; a pass prints nothing. The key should only be read in server code (API routes, server actions, edge functions).
grep -rnE "(NEXT_PUBLIC|VITE|EXPO_PUBLIC)_[A-Z0-9_]*(SERVICE|SECRET)" --exclude-dir=node_modules .
Should do (1)
Turn on Point-in-Time Recovery and test a restore
When Supabase is your databaseDaily backups can lose up to a day of data; PITR restores to the second.
How to verify
Open Database → Backups in the dashboard. The Point in Time tab should show PITR switched on with a recovery window; then restore to a new project once to prove it works. PITR is an add-on on the Pro, Team and Enterprise plans.
Good to have (2)
Connect serverless functions through the connection pooler
When serverless functions connect to Supabase’s databaseEach serverless invocation opening its own connection exhausts Postgres quickly under load.
Check the config
The connection string your serverless functions use should point at the pooler: a host ending in pooler.supabase.com on port 6543 (transaction mode), not the direct database host on 5432.
postgres://postgres.<project-ref>:<password>@<region>.pooler.supabase.com:6543/postgres
Walk through the Supabase production checklist
Covers SSL enforcement, network restrictions, MFA on the org and email rate limits.
How to verify
Work through each section of the checklist, then open Advisors → Security Advisor and Performance Advisor in the dashboard: a pass shows no errors.
Get the checklist for your whole stack
Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.