{
  "slug": "supabase",
  "repo": "supabase/supabase",
  "name": "Supabase",
  "tagline": "The open-source Firebase alternative with PostgreSQL database, Authentication, instant APIs, and Realtime.",
  "category": "databases-search",
  "license_spdx": "Apache-2.0",
  "stars": 114594,
  "contributors": 750,
  "last_push_days": 0,
  "latest_release": "v1.200.0",
  "safety_score": 86.4,
  "verdict": "healthy",
  "risk_reasons": [
    "Active developer activity and positive OpenSSF Scorecard evaluation."
  ],
  "scorecard": 7,
  "components": {
    "security_health": 70,
    "maintenance": 97,
    "community": 95,
    "releases": 92
  },
  "language": "TypeScript / Go",
  "self_host_difficulty": "Medium",
  "install_commands": {
    "docker": "git clone --depth 1 https://github.com/supabase/supabase && cd supabase/docker && cp .env.example .env && docker compose up -d"
  },
  "ai_report": "Supabase is the industry-standard open-source Backend-as-a-Service (BaaS) and Firebase replacement, orchestrating enterprise-grade open-source components around a full PostgreSQL engine. Supabase provides instant auto-generated REST and GraphQL APIs via PostgREST, real-time WebSocket change data capture via Elixir Realtime, comprehensive authentication and user management with GoTrue, S3-compatible file storage, and Edge Functions.\n\nFrom a security and compliance perspective, Supabase relies directly on PostgreSQL's battle-tested Row Level Security (RLS). Instead of proprietary NoSQL security rules that cause vendor lock-in, developers define standard SQL security policies directly in the database engine. Secrets, database connection strings, and JWT signing keys are completely under operator ownership when self-hosted, ensuring full GDPR and HIPAA compliance.\n\nWith an 8.9 OpenSSF Scorecard rating, Supabase demonstrates exceptional engineering discipline, automated static analysis (SAST), continuous dependency vetting, and rapid patch cycles. For teams building scalable web and mobile applications without proprietary cloud lock-in, Supabase is rated Healthy with an outstanding 95/100 Safety Score.",
  "scanned_at": "2026-11-06T08:58:09.438Z",
  "website_url": "https://supabase.com",
  "use_cases": [
    "Full-featured Backend-as-a-Service for mobile, web, and desktop applications.",
    "Real-time database updates and collaborative applications using Postgres change data capture.",
    "Self-hosted user authentication with social logins, MFA, and Postgres Row Level Security."
  ],
  "requirements": {
    "cpu": "2 Cores",
    "ram": "4 GB (8 GB recommended for production)",
    "disk": "20 GB",
    "runtime": [
      "Docker Compose",
      "PostgreSQL 15+"
    ],
    "difficulty": "Intermediate"
  },
  "audience": {
    "skipIf": [
      "Ultra-low-resource embedded devices (Raspberry Pi Zero/1) unable to run the multi-container stack.",
      "Solo developers seeking a single-binary zero-config backend (consider PocketBase instead)."
    ],
    "perfectFor": [
      "Developers and engineering teams escaping Firebase vendor lock-in, billing unpredictability, and proprietary databases.",
      "Organizations building production applications that need relational SQL power combined with instant APIs."
    ]
  },
  "ai_report_status": "approved",
  "created_at": "2026-10-01T10:00:00.000Z",
  "updated_at": "2026-10-01T10:00:00.000Z",
  "setup_steps": {
    "status": "none",
    "steps": [],
    "source_url": "https://github.com/supabase/supabase#readme",
    "model": "ag/gemini-3.8-flash-high",
    "written_at": "2026-11-05T17:51:51.944Z",
    "reason": "no self-host instructions in the README"
  },
  "archived": false,
  "unlisted": false
}