Start here: Supabase & Postgres
Most of what I've written here comes from running Supabase in production. Read these in order, or skip to the section you need.
Begin with the big picture
Next.js + Supabase app in production: what would I do differently
My learnings for building a Next.js and Supabase app and keeping it running in production
Querying through PostgREST
PostgREST/Supabase: joins and join conditions
A look at how postgREST does joins and the gotchas involved
Row level security
Creating a Postgres function for a Supabase RLS policy
Postgres function templates that move repeated access checks out of your Supabase RLS policies, starting with a join table membership check.
Security Testing Supabase PostgREST
Some common enumeration, recon and exfiltration methods for Supabase
Auth
Generating Supabase JWT/access token manually
How to manually generate JWT tokens to use Supabase services as any user
Implement user impersonation in Supabase
Let admins log in as any user in a Next.js and Supabase app, with the code to start and stop impersonation.
Migrating to PKCE-compatible generateLink in Supabase
auth-helpers-nextjs 0.7.0 made PKCE the default and broke generateLink. What changed, and the route handler that fixes it.