Back to Radar

Supabase

Supabase Intelligence

Name: Supabase bug intelligence
Creator: AI & Agent Dev Bug Sandbox

Published reports for this stack, with severity, affected version, and a direct path into each diagnostic.

Similar Reports

high85%

Hosted Supavisor transaction pooler drops pipelined replies causing postgres.js client to hang indefinitely

The hosted Supabase transaction pooler (port 6543) reproduces dropped pipelined PostgreSQL replies when a postgres.js client with prepare:false and max_pipeline:1 sends concurrent unprepared queries. One ParseComplete/ParameterDescription reply is lost and the client promise never resolves, matching Supavisor issues #1061 and fixes #1079/#1176. The deployed pooler version may not include those fixes.

Supavisor

high95%

Studio Exposed functions misrepresents PUBLIC EXECUTE privilege as revoked

Supabase Studio's Exposed functions view computes role access from explicit ACL entries and joins pg_roles, ignoring PostgreSQL's PUBLIC pseudo-role (grantee OID 0). Functions with default PUBLIC EXECUTE are reported as revoked for anon/auth/service_role even though PostgREST allows execution.

Supabase

high45%

Saved SQL queries lost after Supabase incident while functions remain intact

User reports that all saved SQL queries disappeared from Supabase Studio after a Supabase service incident and page refresh, but database functions remain. This suggests queries were stored in a non-persistent or less redundant location compared to functions.

Supabase

high80%

Dashboard Auth Hooks change silently wipes custom SMTP config and resets rate_limit_email_sent

Creating or deleting a Send Email hook in the Supabase dashboard silently nullifies all custom SMTP fields and resets rate_limit_email_sent to default, leading to complete silent auth email failure when the hook is later disabled.

React

high87%

Studio: Password manager can autofill account login into database password fields

Supabase Studio's database password inputs (Reset database password and new project database password) only set autoComplete="off", which password managers like LastPass ignore. This allows the user's Supabase account password to be autofilled into the database password field, creating a credential reuse vulnerability and potential accidental database password exposure.

Next.js

high70%

Persistent 504 errors on Supabase auth endpoints due to database connection pool exhaustion during peak hours

Project zvusdpixljxkxlxrrauj (Pro) experiences 5xx/504 errors on /auth/v1/* during weekday business hours, primarily affecting token refresh and user lookup endpoints. The issue is likely caused by database connection pool exhaustion in the GoTrue auth service under concurrent load, leading to requests exceeding the 60-second timeout.

Supabase

high90%

linkedin_oidc provider uses api.linkedin.com for the authorization redirect instead of www.linkedin.com

The LinkedIn OIDC provider builds its OAuth authorization and token URLs against api.linkedin.com instead of LinkedIn's documented www.linkedin.com endpoint, causing users with an active linkedin.com session to be forced to log in again on every sign-in attempt.

Supabase

high85%

Table Editor drops and re-adds primary key on saves that don't change it

The Table Editor's updateTable function incorrectly compares primary key column names in display order against the primary_keys array (which is in key order). This false mismatch causes the primary key constraint to be dropped and re-added, leading to save failures when foreign keys reference the primary key, or silent reordering of composite primary keys.

Supabase Studio

high82%

Table Editor save falsely drops and recreates primary key on rename or out-of-order composite key

updateTable compares PK column names in display order with primary_keys from the database (key order), causing a name change or an out-of-order composite PK to be treated as a PK change. Studio then drops and re-adds the PK in separate transactions, which fails when foreign keys reference it or silently reorders the PK.

React

high85%

Table Editor drops and re-adds primary key due to order-sensitive column name comparison

updateTable compares primary key column names in display order with the backend's primary_keys array (which comes back in key order). A rename or an out-of-order composite primary key like (b, a) is falsely detected as a PK change, causing Studio to drop and re-add the constraint in separate transactions. This fails when a foreign key references the primary key, blocking unrelated edits, or silently rebuilds the constraint and reorders columns when no FK exists.

Supabase-Studio

high75%

Project default hostname NXDOMAIN despite healthy dashboard status

User reports project gcizehgpcztmqtqhveng is healthy in dashboard but its default supabase.co hostname resolves to NXDOMAIN; DNS record missing or not propagated.

Supabase

medium95%

Table Editor shows the wrong row count when filtering number column by zero

When filtering a numeric column by value 0 in Supabase Table Editor, the visible rows are filtered correctly but the row count still reflects the unfiltered table because the count query omits the filter due to a truthiness check on the converted value 0.

Supabase Studio

medium95%

Blog category filter is lost when loading more posts

When a blog category filter is active, paginated requests to /api-v2/blog-posts omit the category parameter, causing unfiltered posts to be appended to the list.

Next.js

medium82%

Incomplete error responses and missing write-scope explanation in Branching API OpenAPI spec

11 of 12 branching endpoints document only 500 while API returns 401/403/429; GET /v1/branches/{id}/diff uniquely requires environment:write scope but docs don't explain why, causing generated clients to mishandle auth failures and integrators to request excessive permissions.

OpenAPI

medium85%

Fix deprecated and broken links in Supabase observability/inspect documentation

The observability/inspect documentation page contains a Query performance section with multiple broken links and lists several deprecated Supabase CLI inspect subcommands. This misleads users into using outdated commands and leads to dead links. The fix updates the section to reflect the current CLI subcommands, removes deprecated entries from the main list, and adds a deprecation notice.

Supabase

medium85%

Docs recommend unmaintained `npx plugins` command; migrate to `npx skills`

Supabase documentation for AI tools suggests installing plugins via `npx plugins`, but the npm package `plugins` is unmaintained and its GitHub repository returns 404. Vercel has moved this functionality to the `skills` CLI, so the docs should be updated.

Supabase

medium95%

Supabase CLI docs incorrectly reference `inbucket`; should be `local_smtp` with Mailpit

The Supabase local development configuration documentation still shows `[inbucket]` even though the CLI was updated to use `[local_smtp]` backed by Mailpit. This causes confusion and misconfiguration when users copy outdated settings.

Supabase CLI

medium75%

Authentication user details drawer close button does not close the panel

In Supabase Dashboard Authentication > Users, the user details drawer cannot be closed using the top-right close/collapse control. The panel remains open until navigating away; no JavaScript errors are logged.

React

medium72%

Legacy service_role key cannot be revealed or copied in Studio ConnectSheet

After #50516, legacy JWT API keys are masked in ConnectSheet, but reveal/copy actions incorrectly call the secret key reveal API which fails on Supabase-managed projects, preventing users from accessing their service_role key.

React

medium92%

docs(local-dev): Studio cannot access the database when following DEVELOPERS.md for local development

本地开发时，Studio 由于 PG_META_CRYPTO_KEY 环境变量在 Docker Compose 和 Studio 之间不一致，导致无法读取数据库元数据。文档未提供同步说明，造成开发者环境不可用。

Supabase

medium55%

Mobile filter form in Supabase dashboard does not submit on Android Chrome

On Android Chrome, the Authentication → Users filter form has no visible submit button, and pressing the keyboard's enter/go key does not trigger the filter. The form does not submit on mobile or desktop versions, but the issue is most severe on mobile where no button exists.

React

medium95%

Broken local image paths in Croatian and Sinhala READMEs

The translated READMEs under i18n/ contain incorrect repository-relative image paths that resolve to non-existent i18n/apps/... locations instead of the actual repo-root apps/... assets, causing broken images in those documents.

Supabase

medium85%

Infinite loading spinner when accepting AI diff before editor mounts

In the SQL Editor AI, clicking 'Accept Changes' sets a loading state and then returns early if the diff editor is not yet mounted, leaving the button in a perpetual loading state until the page is refreshed.

React

medium85%

React Query spam on GitHub authorization endpoint due to missing retry: false

useGitHubAuthorizationQuery makes redundant retries (3x by default) for 404 responses because retry: false specified in a FIXME was not implemented.

React

medium85%

SQL Editor: “Rename with Supabase AI” returns valid title but does not update the Name field

The AI rename feature in the Supabase Dashboard SQL Editor fetches a valid title and description from the AI endpoint, but the Name field in the Rename dialog remains unchanged after the loading state finishes.

React

medium95%

Broken BotFather image link in elevenlabs-speech-to-text README

The elevenlabs-speech-to-text Edge Function README references a non-existent BotFather screenshot, causing a broken image on GitHub.

Supabase

medium99%

Docs: conflicting descriptions of the private flag for realtime.send / realtime.send_binary

The Supabase Realtime broadcast documentation contains contradictory inline comments for the `private` parameter in SQL examples. Two of three examples reverse the meaning of `true` and `false`, and none explain what the boolean actually does. This can lead developers to accidentally send messages to the wrong channel type (public vs private), causing authorization bypass or unexpected visibility. The underlying SQL functions define `private => true` as private channel (default) and `false` as public channel.

Supabase

medium92%

Malformed dollar quoting in Realtime trigger examples

Three trigger function examples in examples/prompts/use-realtime.md have incorrectly placed AS $$, resulting in invalid SQL that cannot be executed.

Supabase

medium99%

fix(realtime-prompt): INSERT authorization example uses unsupported USING clause

The Supabase realtime prompt documentation contains an invalid PostgreSQL row-level security policy example that uses USING with FOR INSERT. This prevents users from creating the documented private-channel write policy.

PostgreSQL

medium95%

Docs contributor guide points JavaScript v2 authors at retired YAML pipeline

The JavaScript v2 reference contributor instructions in apps/docs/CONTRIBUTING.md still direct authors to edit apps/docs/spec/supabase_js_v2.yml and describe legacy $ref extraction, even though JavaScript v2 now uses the TypeDoc pipeline and is excluded from the legacy generator. This misleads contributors and hides the active authoring workflow.

Vmaster@4ab54b935919ba3f4bb92f436ae4e757108e4f8a Supabase-Docs