{
 "slug": "supabase",
 "name": "Supabase",
 "tagline": "Firebase alternative with Postgres, auth, REST, GraphQL, realtime and storage",
 "category": "developer-platform",
 "use_cases": [
  "backend-as-a-service",
  "postgresql",
  "firebase-alternative"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Supabase",
  "url": "https://supabase.com",
  "license": "Apache-2.0",
  "license_url": "https://github.com/supabase/supabase/blob/master/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "2026.10.12",
   "last_build": "2026-10-25",
   "entity_id": "prod-2g7amfc6ymare",
   "ami_alias": "/aws/service/marketplace/prod-2g7amfc6ymare/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-pohlvhlxtm6ky",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "2026.09.07",
   "last_build": "2026-09-13",
   "offer_id": "supabase",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:supabase:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.supabase?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/supabase/",
  "json": "https://lynxroute.com/products/supabase/product.json"
 },
 "release_notes": [
  {
   "version": "2026.10.12",
   "title": "Supabase 2026.10.12",
   "notes": "* Supabase self-hosted stack updated to the 2026.10.12 snapshot: Studio, Auth, PostgREST, Realtime, Storage, postgres-meta, Edge Runtime, Supavisor, imgproxy and the Kong gateway move to the versions upstream ships with it\n* Security: Storage fixes unauthorized object uploads and overwrites through signed resumable upload URLs (GHSA-8rrf-w776-x75g)\n* Security: Realtime fixes forged broadcast messages on public channels (GHSA-9vjf-j9f7-j42c)\n* Security: the gateway now blocks the Realtime tenant-management API, and the REST OpenAPI root (/rest/v1/) requires the service_role key; table access with the anon key is unchanged\n* The Realtime encryption key is now generated per instance at first boot\n* API_EXTERNAL_URL now ends in /auth/v1, matching upstream; when you move to your own domain, set it to https://your-domain/auth/v1\n* Bundled PostgreSQL stays on 15.8 for data-directory compatibility\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-25"
   }
  },
  {
   "version": "2026.09.07",
   "title": "Supabase 2026.09.07 r2",
   "notes": "* Security: the JWT signing secret is no longer exposed to SQL. Earlier images stored it as the database setting app.settings.jwt_secret, readable by any database session (fixed upstream in supabase/supabase#45003). On an existing instance, run as the postgres superuser: ALTER DATABASE postgres RESET \"app.settings.jwt_secret\"; then remove PGRST_APP_SETTINGS_JWT_SECRET and the db service's JWT_SECRET from /opt/supabase/docker-compose.yml, and rotate the JWT secret and API keys if untrusted users had SQL access\n* Database functions that need the secret should read it from Supabase Vault instead\n* The Supabase stack version is unchanged (2026.09.07); this is a security rebuild\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-09-13"
   }
  },
  {
   "version": "2026.09.07",
   "title": "Supabase 2026.09.07",
   "notes": "* Supabase Studio refreshed from the 2026.08.03 to the 2026.09.07 self-hosted snapshot\n* SQL Editor: custom time ranges are preserved when switching sources, a newly opened tab is no longer discarded on the first keystroke, and renaming a snippet resets correctly between snippets\n* Table Editor: table metadata is refreshed after a table edit, the column name field is focused after adding a column, and a load error now offers a restart action\n* Row Level Security policies accept expressions in the policy editor, and two crashes in the Table and SQL editors are fixed\n* Bundled PostgreSQL deliberately kept on 15.x for data-directory compatibility, so existing volumes keep working across the upgrade\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23",
    "azure": "2026-09-13"
   }
  },
  {
   "version": "2026.08.03",
   "title": "Supabase v-2026.08.03",
   "notes": "* Re-release of Supabase 2026.08.03. The application version is unchanged; this build refreshes the underlying operating system image\n* Bundled PostgreSQL deliberately kept on 15.x for data-directory compatibility - the upstream master branch moves to 17, which would break existing data directories on upgrade\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "2026.08.03",
   "title": "Supabase v2026.08.03",
   "notes": "* Supabase self-host snapshot updated to 2026.08.03 (Studio dashboard refresh; bundled PostgreSQL deliberately kept on 15.x for data-directory compatibility - the upstream master branch moves to 17, which would break existing data directories on upgrade)\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "2026.07.07",
   "title": "Supabase v2026.07.07",
   "notes": "* Supabase self-host snapshot updated to 2026.07.07 (Studio dashboard refresh; bundled PostgreSQL kept on 15.x for data-directory compatibility)\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "aws": "2026-07-23",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "2026.06.03",
   "title": "Supabase 2026.06.03 - Initial release (June 2026)",
   "notes": "* Supabase self-hosted stack (snapshot 2026.06.03) on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Every secret regenerated per instance at first boot: Postgres password, JWT signing secret, dashboard password, Realtime/Supavisor key base, Vault and postgres-meta encryption keys, Storage S3 keys\n* Both API keys (anon and service_role) re-signed per instance from the new JWT secret - the public upstream demo keys are never used\n* Host Nginx fronts the Kong gateway on TCP 443 with a self-signed certificate; HTTP redirects to HTTPS; Studio dashboard behind HTTP basic auth\n* All eleven container images pinned by SHA-256 digest with explicit linux/amd64 platform\n* Kong, Postgres and the Supavisor pooler bind to 127.0.0.1 only; Nginx on 443 is the sole public endpoint\n* UFW firewall pre-configured (TCP 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-01",
    "azure": "2026-06-29"
   }
  }
 ],
 "release_history": [
  {
   "version": "2026.10.12",
   "aws": "2026-10-25"
  },
  {
   "version": "2026.09.07",
   "aws": "2026-10-23",
   "azure": "2026-09-13"
  },
  {
   "version": "2026.08.03",
   "aws": "2026-09-04",
   "azure": "2026-08-19"
  },
  {
   "version": "2026.07.07",
   "aws": "2026-07-23",
   "azure": "2026-07-27"
  },
  {
   "version": "2026.06.03",
   "aws": "2026-07-01",
   "azure": "2026-06-29"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-2g7amfc6ymare/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer supabase --plan payg-gen2\naz vm create -g my-rg -n supabase --size Standard_D2s_v3 \\\n  --image lynxroute:supabase:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Supabase is an open-source Firebase alternative built on PostgreSQL. It turns a Postgres database into a full application backend: instant RESTful and GraphQL APIs over your tables (PostgREST), a complete authentication and user-management server with email and JWT support (GoTrue), realtime subscriptions over WebSockets, S3-compatible object storage with on-the-fly image transformation, serverless edge functions, and the Supabase Studio dashboard for managing it all from the browser. The self-hosted edition runs as a docker-compose deployment of eleven services - Studio, the Kong API gateway, Auth, REST, Realtime, Storage, imgproxy, postgres-meta, Edge Functions, the Postgres database, and the Supavisor connection pooler. Build a backend for web and mobile apps without writing server code: define tables, get APIs and a typed client instantly, manage users, and subscribe to changes. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* Every secret regenerated per instance at first boot - the Postgres password, the JWT signing secret, the dashboard password, the Realtime/Supavisor key base, the Vault and postgres-meta encryption keys, and the Storage S3 keys. The publicly known upstream demo values are never used.\n* Both API keys (anon and service_role) are freshly minted JWTs re-signed from the per-instance JWT secret - the default anon/service-role keys that ship with bare Supabase are public and grant full database access\n* Host Nginx fronts the Kong API gateway on TCP 443 with a self-signed certificate; HTTP redirects to HTTPS; the Studio dashboard is protected by HTTP basic auth\n* All eleven container images (Studio, Kong, Auth, REST, Realtime, Storage, imgproxy, postgres-meta, Edge Functions, PostgreSQL, Supavisor) pinned by SHA-256 digest with explicit linux/amd64 platform - reproducible builds, no surprise upgrades on rebuild\n* Kong, Postgres (5432) and the Supavisor pooler (6543) bind to 127.0.0.1 only - Nginx on 443 is the sole public-facing endpoint by default\n* UFW firewall pre-configured - only TCP 22, 80, 443 are exposed\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nARCHITECTURE NOTES\n\nA single host Nginx vhost on TCP 443 terminates TLS and proxies to the Kong gateway, which routes internally to Studio (/), Auth (/auth/v1), REST and GraphQL (/rest/v1, /graphql/v1), Realtime (/realtime/v1, WebSocket), Storage (/storage/v1), and Edge Functions (/functions/v1). Postgres data and uploaded objects persist at /opt/supabase/volumes/db/data and /opt/supabase/volumes/storage - operators can attach an EBS volume there. Direct database access on ports 5432 (session) and 6543 (transaction pooler) is bound to localhost by default; open it explicitly when you need external connections. Replace the self-signed certificate with a CA-signed certificate for production using Certbot, then set SUPABASE_PUBLIC_URL and SITE_URL in /opt/supabase/.env to your HTTPS hostname (and API_EXTERNAL_URL to the same hostname plus /auth/v1) so auth callbacks, storage URLs and the Studio dashboard use the new origin."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}