supabase-policy-guardrails

# Supabase Policy Guardrails ## Overview Organizational governance for Supabase at scale: a **shared RLS policy library** (reusable templates for common access patterns), **naming conventions** (tables, columns, functions, policies), **migration review process** (CI checks ensuring RLS, preventing destructive operations, enforcing naming), **cost alert configuration** (billing thresholds and usage monitoring), and **security audit scripts** (scanning for exposed keys, missing RLS, overly permissive policies). All patterns use real `createClient` from `@supabase/supabase-js` and Supabase CLI commands. ## Prerequisites - Supabase project with `supabase` CLI installed and linked - `@supabase/supabase-js` v2+ installed - CI/CD pipeline (GitHub Actions recommended) - Database access via `psql` or Supabase SQL Editor - Pro plan recommended for cost alerts and usage API ## Step 1 — Shared RLS Policy Library and Naming Conventions ### RLS Policy Templates Create reusable RLS policy templates that teams apply to new tables. This prevents each developer from writing ad-hoc policies and ensures consistent access control. ```sql -- supabase/migrations/00000000000000_rls_policy_library.sql -- Shared RLS policy library — apply these templates to new tables -- ============================================================ -- Template 1: Owner-only access (user owns the row) -- Usage: tables with a user_id column (todos, profiles, settings) -- =========================================...