supabase-known-pitfalls

Use when reviewing Supabase code, onboarding developers, auditing an existing project, or debugging unexpected behavior — catches the twelve most common Supabase mistakes: exposing the service_role key in client bundles, forgetting to enable RLS, skipping connection pooling in serverless, .single() throwing on empty results, missing .select() after insert/update, ignoring { data, error }, creating multiple client instances, and not using generated types. Trigger with phrases like "supabase mistakes", "supabase anti-patterns", "supabase pitfalls", "supabase code review", "supabase gotchas", "supabase debugging", "what not to do supabase", "supabase common errors".

インストールへ移動

リポジトリ: jeremylongshore/claude-code-plugins-plus-skills
ソースの最終更新活動: 2026年7月17日 23:53
検出された SKILL.md の言語: 英語
スター: 2,604
フォーク: 378

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/jeremylongshore/claude-code-plugins-plus-skills --skill supabase-known-pitfalls

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

ファイルエクスプローラー

5 ファイル

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

clerk-core-workflow-a

Implement user sign-up and sign-in flows with Clerk. Use when building authentication UI, customizing sign-in experience, or implementing OAuth social login. Trigger with phrases like "clerk sign-in", "clerk sign-up", "clerk login flow", "clerk OAuth", "clerk social login".

2026-07-23

clerk-core-workflow-b

Implement session management and middleware with Clerk. Use when managing user sessions, configuring route protection, or implementing token refresh and custom JWT templates. Trigger with phrases like "clerk session", "clerk middleware", "clerk route protection", "clerk token", "clerk JWT".

2026-07-23

clerk-enterprise-rbac

Configure enterprise SSO, role-based access control, and organization management. Use when implementing SSO integration, configuring role-based permissions, or setting up organization-level controls. Trigger with phrases like "clerk SSO", "clerk RBAC", "clerk enterprise", "clerk roles", "clerk permissions", "clerk organizations".

2026-07-23

このリポジトリのすべてを見る

Supabase Known Pitfalls

Overview

The twelve most common Supabase mistakes, ranked by severity: security (service_role exposure, missing RLS, permissive policies, no connection pooling), data integrity (ignoring { data, error }, missing .select() after mutations, .single() on optional results), and performance / maintainability (select('*'), N+1 queries, missing FK indexes, multiple client instances, no generated types). Each pitfall shows the broken code, why it fails, and the correct pattern using createClient from @supabase/supabase-js.

This SKILL.md carries the full pitfall table plus one representative fix per category. The verbatim broken-vs-correct code and detection queries for all twelve live in references/pitfalls.md — drill in there for depth.

Prerequisites

Access to a Supabase project codebase for review

@supabase/supabase-js v2+ installed

Basic understanding of Row Level Security (RLS)

Instructions

Work the pitfalls top-down by severity. Fix every Critical finding before moving on — a single security miss can expose the whole database.

Pitfall

Severity

Fix

service_role key in client bundle

Critical

anon key on client; service_role server-only, no NEXT_PUBLIC_

Table without RLS

Critical

ALTER TABLE … ENABLE ROW LEVEL SECURITY right after CREATE TABLE

Overly permissive RLS policy

Critical

scope USING (…) to auth.uid(), never USING (true) for writes

No connection pooling in serverless

Critical

pooled string (Supavisor, port 6543), not the direct 5432 URL

Ignoring { data, error }

High

destructure both; check error before touching data

Supabase Known Pitfalls

Overview

Prerequisites

Access to a Supabase project codebase for review

@supabase/supabase-js v2+ installed

Basic understanding of Row Level Security (RLS)

Instructions

Work the pitfalls top-down by severity. Fix every Critical finding before moving on — a single security miss can expose the whole database.

Pitfall

Severity

Fix

service_role key in client bundle

Critical

anon key on client; service_role server-only, no NEXT_PUBLIC_

Table without RLS

Critical

ALTER TABLE … ENABLE ROW LEVEL SECURITY right after CREATE TABLE

Overly permissive RLS policy

Critical

scope USING (…) to auth.uid(), never USING (true) for writes

No connection pooling in serverless

Critical

pooled string (Supavisor, port 6543), not the direct 5432 URL

Ignoring { data, error }

High

destructure both; check error before touching data

name	supabase-known-pitfalls
description	Use when reviewing Supabase code, onboarding developers, auditing an existing project, or debugging unexpected behavior — catches the twelve most common Supabase mistakes: exposing the service_role key in client bundles, forgetting to enable RLS, skipping connection pooling in serverless, .single() throwing on empty results, missing .select() after insert/update, ignoring { data, error }, creating multiple client instances, and not using generated types. Trigger with phrases like "supabase mistakes", "supabase anti-patterns", "supabase pitfalls", "supabase code review", "supabase gotchas", "supabase debugging", "what not to do supabase", "supabase common errors".
allowed-tools	Read, Grep
version	1.53.0
license	MIT
author	Jeremy Longshore <jeremy@intentsolutions.io>
tags	["saas","supabase","anti-patterns","code-review","debugging","security","pitfalls"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

name	supabase-known-pitfalls
description	Use when reviewing Supabase code, onboarding developers, auditing an existing project, or debugging unexpected behavior — catches the twelve most common Supabase mistakes: exposing the service_role key in client bundles, forgetting to enable RLS, skipping connection pooling in serverless, .single() throwing on empty results, missing .select() after insert/update, ignoring { data, error }, creating multiple client instances, and not using generated types. Trigger with phrases like "supabase mistakes", "supabase anti-patterns", "supabase pitfalls", "supabase code review", "supabase gotchas", "supabase debugging", "what not to do supabase", "supabase common errors".
allowed-tools	Read, Grep
version	1.53.0
license	MIT
author	Jeremy Longshore <jeremy@intentsolutions.io>
tags	["saas","supabase","anti-patterns","code-review","debugging","security","pitfalls"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Issue	Cause	Solution
`PGRST116: JSON object requested, multiple (or no) rows returned`	Used `.single()` when 0 or 2+ rows match	Use `.maybeSingle()` for optional lookups
`data` is `null` after insert	Missing `.select()` chain	Add `.select('column1, column2')` after `.insert()`
`TypeError: Cannot read property of null`	Destructured only `data`, ignoring `error`	Always destructure `{ data, error }` and check error first
`too many connections for role`	Direct connection from serverless	Use pooled connection string (port 6543)
`permission denied for table`	RLS blocking access, no matching policy	Check RLS policies match the authenticated user's JWT claims
`relation does not exist`	Table name typo, not caught at compile time	Use generated types for compile-time validation

supabase-known-pitfalls

インストール方法

ソースファイルを確認