Backend platforms
Both are offered as hosted services, so the useful comparison is each vendor’s track record, SDK and licence rather than version support. Supabase is open source (Apache-2.0); Convex is source-available under FSL-1.1-Apache-2.0. In the last 90 days Supabase’s status feed logged 16 or more incidents and Convex’s 5.
Last checked against Supabase Status, npm, deps.dev, OSV.dev and Convex Status.
Every value links to its source. Where a row doesn’t apply to one of them, the cell says why.
| Compared on |  Supabase |  Convex |
|---|---|---|
| Support and releases | ||
| Latest release | ||
| Releases in the last 12 months | ||
| Security | ||
| Advisories published in the last 12 months | ||
| OpenSSF Scorecard | No Scorecard published | |
| Status and incidents | ||
| Status now | Operational | Operational |
| Incidents in the last 90 days | ||
| Licence and hosting | ||
| Licence | FSL-1.1-Apache-2.0 Source-available, not open source Fair Source: each release becomes Apache 2.0 after two years; until then it can’t be offered as a competing hosted product. SDK (convex): Apache-2.0. | |
| How you run it | Supabase’s managed platform, or self-host the open-source stack | Convex’s managed cloud, or self-host the open-source backend |
| Adoption | ||
| npm downloads last week | ||
| GitHub stars | ||
| Supabase | Convex |
|---|---|
| Latest release | |
| Releases in the last 12 months | |
| Supabase | Convex |
|---|---|
| Advisories published in the last 12 months | |
| OpenSSF Scorecard | |
No Scorecard published | |
| Supabase | Convex |
|---|---|
| Status now | |
Operational | Operational |
| Incidents in the last 90 days | |
| Supabase | Convex |
|---|---|
| Licence | |
FSL-1.1-Apache-2.0 Source-available, not open source Fair Source: each release becomes Apache 2.0 after two years; until then it can’t be offered as a competing hosted product. SDK (convex): Apache-2.0. | |
| How you run it | |
Supabase’s managed platform, or self-host the open-source stack | Convex’s managed cloud, or self-host the open-source backend |
| Supabase | Convex |
|---|---|
| npm downloads last week | |
| GitHub stars | |
Read across for what matters to you. Each answer comes from the data above or the project’s licence and hosting options.
| If you need | Supabase | Convex |
|---|---|---|
| An open-source licence | Yes: Apache-2.0 | No: Source-available (FSL-1.1-Apache-2.0) |
| Someone else runs it for you | Yes: From Supabase | Yes: From Convex |
| You can run it on your own servers | Yes: Self-hosting is documented | Yes: Self-hosting is documented |
| A public incident history | Yes: Status page with 90-day history | Yes: Status page with 90-day history |
| Supabase | Convex |
|---|---|
| An open-source licence | |
Yes: Apache-2.0 | No: Source-available (FSL-1.1-Apache-2.0) |
| Someone else runs it for you | |
Yes: From Supabase | Yes: From Convex |
| You can run it on your own servers | |
Yes: Self-hosting is documented | Yes: Self-hosting is documented |
| A public incident history | |
Yes: Status page with 90-day history | Yes: Status page with 90-day history |
Open-source Firebase alternative
Backend platform with reactive real-time database
From StackPrism’s curated notes. Pricing isn’t covered here: it changes often, so check each vendor’s pricing page.
Both give you a hosted database and server-side functions with a TypeScript client, and both can be self-hosted. The difference is the model: Supabase is PostgreSQL, so you write SQL or use its query builder, while Convex stores documents and you write queries and mutations as TypeScript functions whose results update live in the client.
Release lines and end-of-life dates come from endoflife.date, release counts from deps.dev’s publish dates, and advisories from OSV.dev, counted once per flaw even when it’s listed under several ids, and checked against CISA’s list of vulnerabilities known to be exploited. Status and incident history come from each vendor’s public status feed; licences from each project’s licence file or the vendor’s licensing page, linked in the table.
The data refreshes every few hours and the time it was checked is shown above. There’s no pricing and no overall winner: which one fits depends on your constraints. To see how the versions you actually run hold up, check your repo.
Paste a public GitHub repo and see what’s vulnerable, end of life or deprecated in it today. Free, no sign-up.