supabase-known-pitfalls

# Supabase Known Pitfalls ## Overview The twelve most common Supabase mistakes, ranked by severity: **security** (service_role exposure, missing RLS, permissive policies), **data integrity** (ignoring `{ data, error }`, missing `.select()` after mutations, `.single()` on optional results), **performance** (`select('*')`, N+1 queries, missing FK indexes, synchronous auth checks), and **maintainability** (no generated types, multiple client instances, hardcoded connection strings). Each pitfall shows the broken code, explains why it fails, and provides the correct pattern using `createClient` from `@supabase/supabase-js`. ## Prerequisites - Access to a Supabase project codebase for review - `@supabase/supabase-js` v2+ installed - Basic understanding of Row Level Security (RLS) ## Step 1 — Security Pitfalls (Critical) These mistakes can expose all your data to any user with browser dev tools. ### Pitfall 1: Exposing service_role Key in Client Code ```typescript // BAD: service_role key in a NEXT_PUBLIC_ variable — shipped to every browser import { createClient } from '@supabase/supabase-js' const supabase = createClient( process.env.NEXT_PUBLIC_SUPABASE_URL!, process.env.NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY! // CATASTROPHIC ) // This key bypasses ALL RLS. Anyone can: // - Read every row in every table // - Delete the entire database // - Create admin users // - Access every file in storage // CORRECT: anon key on client, service_role only on server // Client (bro...