BeforeMerge: Supabase Review

Comprehensive code review knowledge base for Supabase applications. Contains rules across 4 categories — security, performance, architecture, and quality — prioritized by impact.

When to Apply

Reference these rules when:

Reviewing pull requests that touch Supabase queries, RLS policies, or migrations
Writing new database tables, policies, or server-side Supabase calls
Auditing existing code for RLS gaps, auth misuse, or query anti-patterns
Refactoring Supabase integration for performance or maintainability
Running pre-merge quality checks on Supabase-related changes

Rule Categories by Priority

Priority	Category	Impact	Prefix	Focus
1	Security	CRITICAL	`sec-`	RLS, auth, service role, migration safety
2	Performance	HIGH	`perf-`	Query optimization, connection pooling, pagination
3	Architecture	MEDIUM	`arch-`	Client selection, type generation, migration structure
4	Quality	LOW-MEDIUM	`qual-`	Error handling, input validation, unchecked errors

How to Use

Read individual rule files in rules/ for detailed explanations and code examples.

Each rule contains:

Brief explanation of why it matters
Incorrect code example with explanation
Correct code example with explanation
CWE/OWASP mapping where applicable
References to official documentation

For the complete compiled guide: AGENTS.md

beforemerge-supabase-review

BeforeMerge: Supabase Review

When to Apply

Rule Categories by Priority

How to Use

Security(10)

Use getUser() Instead of getSession()

Use getUser() Instead of getSession() for Auth Checks

Never Expose Service Role Key in Client-Side Code

Never Use Service Role Client in Auth-Context Routes

Prevent SQL Injection in Custom RPC Functions

Enable RLS on Every Table

Enable RLS on Every Table with Complete Policies

Use Migration Files Instead of MCP or Dashboard SQL

Close RLS Policy Gaps for All Operations

Never Log Sensitive Data

Performance(6)

Add Indexes for Filtered and Ordered Columns

Avoid N+1 Queries with Supabase Relational Selects

Use Batch Operations Instead of Single-Row Loops

Use Connection Pooling (Supavisor) for Serverless Deployments

Use Cursor-Based Pagination Instead of Offset Pagination

Avoid select('*') — Request Only the Columns You Need

Quality(3)

Always Check Error Before Using Data from Supabase Queries

Validate Input at Runtime with Zod Instead of Type Assertions

Distinguish Not-Found from Other Supabase Errors

Architecture(3)

Use the Correct Supabase Client for Each Context

Follow Canonical Migration File Structure

Generate Database Types from Schema

Automate beforemerge-supabase-review checks on every PR