# Supabase Postgres Best Practices

Supabase Postgres Best Practices (supabase-postgres-best-practices) is a skill by Supabase that teaches coding agents Postgres rules for schema design, RLS policies, indexes and migrations.

Skill · Picked · by Supabase · Works with Claude Code, Codex · Updated 2026-10-21

Made by [Supabase](https://supabase.com). Source: [github.com/supabase/agent-skills](https://github.com/supabase/agent-skills/tree/main/skills/supabase-postgres-best-practices) · MIT license. The text below is Lior's notes on why and how he uses it; the original files live at the source.

## Install

```sh
npx skills add supabase/agent-skills --skill supabase-postgres-best-practices
```

## Verdict

Score: 6/10 · Tested 2026-10-21 · v1.6.0

A safety net more than an upgrade. The agent already wrote a secure migration without it, and the skill added a few hardening details, not a better design.

### Pros

- Added hardening the plain run skipped: RLS forced even for the table owner, and helper functions moved to a schema the API doesn't expose.
- Made the streak trigger handle a batch of check-ins at once, which fits apps that sync offline changes.
- Covers far more than schemas: indexes, slow queries, locking, pg_cron and pgvector, all in one skill.
- Free and MIT licensed, and maintained by Supabase.

### Cons

- On a typical migration the difference was small. Both runs enabled RLS on every table, locked down default grants and checked ownership the same way.
- The run without the skill made the better product call: it worked out the current streak in each habit's own timezone. The skill's version left that to the app.
- Cost about 15% more for the same task, because the agent reads the skill's rules first.

Best for: Anyone shipping on Supabase who wants a second check on schema and RLS before a migration goes live.

Skip it if: You review every migration yourself and already know Postgres security well.

## The test

Task (same for both runs): Write the Postgres schema migration for Streak, a habit-tracking iPhone app on Supabase: users' habits, daily check-ins, and current/longest streak per habit. Users must only ever see their own data. Put it in one file, migration.sql, in the current directory.

### Without the skill

1.7 min · $0.36

- 319 lines, 3 tables, 8 RLS policies
- RLS enabled on all tables, not forced
- Default Supabase grants revoked
- Ownership enforced with a combined foreign key
- Current streak computed per habit timezone in a view

### With supabase-postgres-best-practices

1.6 min · $0.42

- 268 lines, 3 tables, 8 RLS policies
- RLS enabled and forced on all tables
- Default Supabase grants revoked
- Helper functions in a private schema
- Streak trigger handles batches of check-ins
- Current streak left to the app to compare with local today

### What I found

- Both migrations were secure: RLS on every table, policies using (select auth.uid()), grants locked down and ownership checked across tables.
- The skill's version added defense in depth: forced RLS and a private schema for helper functions.
- The version without the skill handled "current streak" better, using each habit's timezone, while the skill's version left that to the app.
- Neither run could execute the SQL: there was no Postgres server on the test machine, so both were checked by reading.

_How I ran it: Claude Code 2.1.306 with Claude Opus, run headless twice with only Claude Code's built-in skills loaded (no user skills, plugins or MCP servers). The second run had supabase-postgres-best-practices installed in the project and its prompt started with "Use the supabase-postgres-best-practices skill."_

## Questions

### Who made supabase-postgres-best-practices?

Supabase. It's published in github.com/supabase/agent-skills under the MIT license. This page is my review of it.

### Does it only work with Supabase?

No. The rules are for Postgres running anywhere, though some examples use Supabase features.

## Related

- [Impeccable](https://www.liorpesoa.com/library/impeccable.md)

## Credit

Supabase · [github.com/supabase/agent-skills](https://github.com/supabase/agent-skills/tree/main/skills/supabase-postgres-best-practices) · MIT license

---

Page: https://www.liorpesoa.com/library/supabase-postgres-best-practices
Library: https://www.liorpesoa.com/library