supabase-prod-checklist

# Supabase Production Deployment Checklist ## Overview Actionable 14-step checklist for taking a Supabase project to production. Covers RLS enforcement, key separation, connection pooling (Supavisor), backups/PITR, network restrictions, custom domains, auth emails, rate limits, monitoring, Edge Functions, Storage policies, indexes, and migrations. Based on Supabase's official [production guide](https://supabase.com/docs/guides/deployment/going-into-prod). ## Prerequisites - Supabase project on Pro plan or higher (required for PITR, network restrictions) - Separate production project (never share dev/prod) - `@supabase/supabase-js` v2+ installed - Supabase CLI installed (`npx supabase --version`) - Domain and DNS configured for custom domain - Deployment platform ready (Vercel, Netlify, Cloudflare, etc.) ## Instructions ### Step 1: Enforce Row Level Security on ALL Tables RLS is the single most critical production requirement. Without it, any client with your anon key can read/write every row. ```sql -- Audit: find tables WITHOUT RLS enabled -- This query MUST return zero rows before going live SELECT schemaname, tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public' AND rowsecurity = false; ``` ```sql -- Enable RLS on a table ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY; -- Create a basic read policy (authenticated users see own rows) CREATE POLICY "Users can view own profile" ON public.profiles FOR SELECT USING (auth.uid() = user_id); -- ...