How Supabase became the default backend

Ask an AI app builder for an app with accounts and a database, and the data will often end up in Supabase. In June the company said that more than 60 percent of the new databases on its platform are launched “by some sort of AI tool”.

We should say where we stand. Werk, our app platform, uses Supabase where a project fits it, so we know it from daily work. Here is how it got here, what is good, what is not, and our verdict.

What it is

Supabase was founded in 2020 by Paul Copplestone and Ant Wilson and started out at Y Combinator. Its pitch was an open source alternative to Google’s Firebase, built not on a proprietary store but on Postgres, the database many developers already know and trust. Around it sits what an app needs next: sign in, APIs generated from the tables, file storage and a toolkit for vector search.

Today it describes itself in one line: “Supabase is the Postgres development platform.” The code is public under the Apache 2.0 licence. It is built for people who want a real database without running one: founders with a first version, product teams, agencies, and now the tools that write apps for all of them.

How the AI builders made it the default

The app builders needed exactly that: one service for a generated app’s database, sign in and storage. When Lovable launched Lovable Cloud in September 2025, Supabase wrote: “Every project created in Lovable Cloud is powered by Supabase behind the scenes.” More than 40'000 new databases were launched on its platform each day, it said. Days later, reporting on its next funding round, TechCrunch named Lovable and Bolt among the vibe coding tools whose backends use it.

Then the coding agents came. In June 2026 Supabase reported that database launches had grown 600 percent in a year, and that nearly 10 million developers build on it, more than twice as many as eight months earlier. Growth had accelerated since January, it wrote, as “Claude Code and Codex expand the number of people who can build.”

The money

Supabase raised an 80 million dollar Series C in 2024, 200 million at a valuation of 2 billion in 2025, and 100 million at 5 billion in October 2025, a round in which members of its community could also buy shares. In June 2026 it raised 500 million dollars at a valuation of 10 billion before the new money, led by GIC, with Stripe investing a second time and Salesforce Ventures joining. Part of it pays for liquidity for employees, who may sell some of their vested shares in each round.

What is genuinely good

The best thing about Supabase is that it is Postgres. The schema is plain SQL, the data sits in tables with real relations and transactions, and the skills and tools a team already has still apply. In our experience that also makes it good ground for agents: a schema written as SQL migrations is explicit, readable and reviewable, which suits code written by AI better than a loose document store.

It is quick to start. The free plan includes a 500 MB database and 50'000 monthly active users, enough to test an idea with real people. And it is open. The platform is open source and can be self hosted, and because the database is standard Postgres, a team can take its data elsewhere with ordinary tools.

What to watch

Security comes first. The key in the browser is meant to be public. What protects the data is row level security, rules in the database that decide who may read or write each row. Supabase’s documentation is precise about the default: “Tables created through the Supabase Dashboard have RLS enabled by default.” Tables made in the SQL editor or “through another tool” need it switched on explicitly, and that is how agents and migrations usually create them.

The gap has shown. In May 2025 the researcher Matt Palmer reported that 170 of 1'645 apps showcased by Lovable had missing or misconfigured row level security, exposing data such as emails, phone numbers and payment details. Lovable disputed the resulting vulnerability record, saying each customer is responsible for protecting its own data.

In September 2026 the security firm UpGuard found more than 16'000 Supabase databases with tables anyone could read, more than half of them holding personal data. BleepingComputer reported the cause as “missing or ineffective row-level security policies and misuse of public keys”, though the scans did not establish that every site was built with an AI agent. Supabase’s security chief, Bil Harmer, told TechCrunch that projects are “secure by default” and that customers control how their own projects are configured.

Cost comes second. Pro starts at 25 dollars a month and includes 10 dollars of compute, enough for the smallest instance. Every further project pays its full compute, from 10 dollars a month for the smallest size to 3'730 dollars for the largest listed, and data transfer beyond 250 GB costs 0.09 dollars per GB. A spend cap is on by default on Pro, and the Team plan starts at 599 dollars. In our view the prices are fair and clearly published, but the bill follows compute and traffic, and many small projects add up.

Lock in, as we see it, is lower than with most platforms of its kind. The database leaves easily. Sign in, storage and the client libraries are where an app grows into Supabase, and where a move would take real work.

Our verdict

Supabase deserves its place as the default backend for new web and mobile apps that need accounts and data, and the reason is unglamorous: it is Postgres, with good tooling, fair published prices and a way out. Its weakness is the one every fast tool shares. It makes a working app easy, and a safe app a separate step that an agent will not always take.

So use it, and treat security as part of the build: row level security on every table that can be reached from outside, policies that are tested rather than assumed, secret keys only on the server, and a spend cap until you know your traffic. That is how we use it in Werk, where Supabase is one of the parts we choose per project, next to Next.js, React and Expo. AI writes most of the code, people review every release, and roles, sign in, encryption and automated tests are there from the first version.