# Supabase 109 Hacker News commenters recommended Supabase and 56 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months. **Verdict:** A managed Postgres backend with built-in auth and functions that saves setup and ops work, with a usable free tier; critics warn RLS security is easy to get wrong. ## Why people recommend it - Saves backend and ops work (5 comments): "Supabase adds a huge amount of value. The fact that I don't have to code half of things that I otherwise would is great to start something." ([source](https://news.ycombinator.com/item?id=48023349)) "minimal ops overhead and you can focus on the actual product instead of infrastructure" ([source](https://news.ycombinator.com/item?id=47086984)) "using RDS or Supabase saves weeks of time on upgrades, replicas, tuning, and backups" ([source](https://news.ycombinator.com/item?id=46341239)) - Generous free tier (3 comments): "If your API can run on the edge, you can get a database, function calling and user auth on Supabase's free tier." ([source](https://news.ycombinator.com/item?id=47552683)) "we currently don't even need paid tiers of supabase since our software is so small" ([source](https://news.ycombinator.com/item?id=48045835)) "100% free, because you can use the free tier plan on both Supabase and Val Town" ([source](https://news.ycombinator.com/item?id=46205816)) - Built-in auth, database and functions (3 comments): "I currently use Supabase to avoid having to set up my own user auth on Workers, but I would much prefer to use D1 etc." ([source](https://news.ycombinator.com/item?id=48670733)) "If your API can run on the edge, you can get a database, function calling and user auth on Supabase's free tier." ([source](https://news.ycombinator.com/item?id=47552683)) "If you're building a paid service you're probably already using cognito or supabase or something." ([source](https://news.ycombinator.com/item?id=49123264)) - Security warnings and advisories (3 comments): "pretty good at warning you about these things in their project specific security advisories" ([source](https://news.ycombinator.com/item?id=46357992)) "Supabase yells really loudly if you have RLS turned off with their own AI agent" ([source](https://news.ycombinator.com/item?id=48016326)) "They do a lot more nowadays to make it clear to the user what is happening, but it still feels unnatural to me." ([source](https://news.ycombinator.com/item?id=46368606)) ## What people warn about - RLS security easy to misconfigure (6 comments): "the very first thing you do is `GRANT ALL ON table TO authenticated` (and often `anon`) because nothing works through the client SDK without it" ([source](https://news.ycombinator.com/item?id=47001330)) "Is this standard practice with using Supabase to simply expose the production database endpoint to the world with only RLS to protect you?" ([source](https://news.ycombinator.com/item?id=46863593)) "Supabase should really rethink publicly exposing the default schema without explicit consent from the developer." ([source](https://news.ycombinator.com/item?id=46358347)) - Self-hosting is hard and incomplete (3 comments): "It's not single binary, you need to spin up a dozen or so containers and have a full DevOps team on standby if self hosting." ([source](https://news.ycombinator.com/item?id=47064569)) "back-ends that pretend to support self-hosting but make it difficult by perpetuating massive gaps in its documentation" ([source](https://news.ycombinator.com/item?id=46417458)) "they stripped all multi-tenant features and even the selfhosted version is missing essential features" ([source](https://news.ycombinator.com/item?id=47064853)) ## Alternatives hackers recommend - [Firebase](https://hackerapproved.com/p/firebase.md): 26 recommend - [Convex](https://hackerapproved.com/p/convex.md): 10 recommend ## Where to get it - [Visit the official site](https://supabase.com/) ## Cite as Hacker Approved, "Supabase", https://hackerapproved.com/p/supabase/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).