supabase-known-pitfalls

Use when reviewing Supabase code, onboarding developers, auditing an existing project, or debugging unexpected behavior — catches the twelve most common Supabase mistakes: exposing the service_role key in client bundles, forgetting to enable RLS, skipping connection pooling in serverless, .single() throwing on empty results, missing .select() after insert/update, ignoring { data, error }, creating multiple client instances, and not using generated types. Trigger with phrases like "supabase mistakes", "supabase anti-patterns", "supabase pitfalls", "supabase code review", "supabase gotchas", "supabase debugging", "what not to do supabase", "supabase common errors".

跳到安装

仓库: jeremylongshore/claude-code-plugins-plus-skills
最近来源活动: 2026年7月17日 23:53
检测到的 SKILL.md 语言: 英语
星标: 2,604
分支: 378

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/jeremylongshore/claude-code-plugins-plus-skills --skill supabase-known-pitfalls

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

5 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

clerk-core-workflow-a

Implement user sign-up and sign-in flows with Clerk. Use when building authentication UI, customizing sign-in experience, or implementing OAuth social login. Trigger with phrases like "clerk sign-in", "clerk sign-up", "clerk login flow", "clerk OAuth", "clerk social login".

2026-07-23

clerk-core-workflow-b

Implement session management and middleware with Clerk. Use when managing user sessions, configuring route protection, or implementing token refresh and custom JWT templates. Trigger with phrases like "clerk session", "clerk middleware", "clerk route protection", "clerk token", "clerk JWT".

2026-07-23

clerk-enterprise-rbac

Configure enterprise SSO, role-based access control, and organization management. Use when implementing SSO integration, configuring role-based permissions, or setting up organization-level controls. Trigger with phrases like "clerk SSO", "clerk RBAC", "clerk enterprise", "clerk roles", "clerk permissions", "clerk organizations".

2026-07-23

查看这个仓库的全部 Skills

Supabase Known Pitfalls

Overview

The twelve most common Supabase mistakes, ranked by severity: security (service_role exposure, missing RLS, permissive policies, no connection pooling), data integrity (ignoring { data, error }, missing .select() after mutations, .single() on optional results), and performance / maintainability (select('*'), N+1 queries, missing FK indexes, multiple client instances, no generated types). Each pitfall shows the broken code, why it fails, and the correct pattern using createClient from @supabase/supabase-js.

This SKILL.md carries the full pitfall table plus one representative fix per category. The verbatim broken-vs-correct code and detection queries for all twelve live in references/pitfalls.md — drill in there for depth.

Prerequisites

Access to a Supabase project codebase for review

@supabase/supabase-js v2+ installed

Basic understanding of Row Level Security (RLS)

Instructions

Work the pitfalls top-down by severity. Fix every Critical finding before moving on — a single security miss can expose the whole database.

Pitfall

Severity

Fix

service_role key in client bundle

Critical

anon key on client; service_role server-only, no NEXT_PUBLIC_

Table without RLS

Critical

ALTER TABLE … ENABLE ROW LEVEL SECURITY right after CREATE TABLE

Overly permissive RLS policy

Critical

scope USING (…) to auth.uid(), never USING (true) for writes

No connection pooling in serverless

Critical

pooled string (Supavisor, port 6543), not the direct 5432 URL

Ignoring { data, error }

High

destructure both; check error before touching data

Supabase Known Pitfalls

Overview

Prerequisites

Access to a Supabase project codebase for review

@supabase/supabase-js v2+ installed

Basic understanding of Row Level Security (RLS)

Instructions

Work the pitfalls top-down by severity. Fix every Critical finding before moving on — a single security miss can expose the whole database.

Pitfall

Severity

Fix

service_role key in client bundle

Critical

anon key on client; service_role server-only, no NEXT_PUBLIC_

Table without RLS

Critical

ALTER TABLE … ENABLE ROW LEVEL SECURITY right after CREATE TABLE

Overly permissive RLS policy

Critical

scope USING (…) to auth.uid(), never USING (true) for writes

No connection pooling in serverless

Critical

pooled string (Supavisor, port 6543), not the direct 5432 URL

Ignoring { data, error }

High

destructure both; check error before touching data

name	supabase-known-pitfalls
description	Use when reviewing Supabase code, onboarding developers, auditing an existing project, or debugging unexpected behavior — catches the twelve most common Supabase mistakes: exposing the service_role key in client bundles, forgetting to enable RLS, skipping connection pooling in serverless, .single() throwing on empty results, missing .select() after insert/update, ignoring { data, error }, creating multiple client instances, and not using generated types. Trigger with phrases like "supabase mistakes", "supabase anti-patterns", "supabase pitfalls", "supabase code review", "supabase gotchas", "supabase debugging", "what not to do supabase", "supabase common errors".
allowed-tools	Read, Grep
version	1.53.0
license	MIT
author	Jeremy Longshore <jeremy@intentsolutions.io>
tags	["saas","supabase","anti-patterns","code-review","debugging","security","pitfalls"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

name	supabase-known-pitfalls
description	Use when reviewing Supabase code, onboarding developers, auditing an existing project, or debugging unexpected behavior — catches the twelve most common Supabase mistakes: exposing the service_role key in client bundles, forgetting to enable RLS, skipping connection pooling in serverless, .single() throwing on empty results, missing .select() after insert/update, ignoring { data, error }, creating multiple client instances, and not using generated types. Trigger with phrases like "supabase mistakes", "supabase anti-patterns", "supabase pitfalls", "supabase code review", "supabase gotchas", "supabase debugging", "what not to do supabase", "supabase common errors".
allowed-tools	Read, Grep
version	1.53.0
license	MIT
author	Jeremy Longshore <jeremy@intentsolutions.io>
tags	["saas","supabase","anti-patterns","code-review","debugging","security","pitfalls"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Issue	Cause	Solution
`PGRST116: JSON object requested, multiple (or no) rows returned`	Used `.single()` when 0 or 2+ rows match	Use `.maybeSingle()` for optional lookups
`data` is `null` after insert	Missing `.select()` chain	Add `.select('column1, column2')` after `.insert()`
`TypeError: Cannot read property of null`	Destructured only `data`, ignoring `error`	Always destructure `{ data, error }` and check error first
`too many connections for role`	Direct connection from serverless	Use pooled connection string (port 6543)
`permission denied for table`	RLS blocking access, no matching policy	Check RLS policies match the authenticated user's JWT claims
`relation does not exist`	Table name typo, not caught at compile time	Use generated types for compile-time validation

supabase-known-pitfalls

安装方式

检查来源文件