The Postgres development platform. Supabase gives you a dedicated Postgres database to build your web, mobile, and AI applications.
This report summarizes scanner evidence for supabase/supabase, a TypeScript project with 114,368 GitHub stars. SynthScan examined 1,587,374 lines of code across 10384 source files, recording 1344 pattern matches distributed across 17 syntactic categories. The legacy adjusted pattern signal is 1.2 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 1060 finding(s).
Are imports declared and package/API names verified? 137 finding(s).
Are wrappers, guards, and repeated structures necessary? 930 finding(s).
Which changes need focused human review? 1344 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1344 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/safe-sql-execution/SKILL.md | 300 | function markFunctionDefinitionSafe( | CODE |
| LOW | .agents/skills/safe-sql-execution/SKILL.md | 322 | function markFunctionDefinitionSafe( | CODE |
| LOW | …mples/ai/aws_bedrock_image_search/image_search/main.py | 33 | def construct_bedrock_image_body(base64_string): | CODE |
| LOW | …mples/ai/aws_bedrock_image_search/image_search/main.py | 46 | def get_embedding_from_titan_multimodal(body): | CODE |
| LOW | …management/expo-push-notifications/components/Push.tsx | 38 | async function registerForPushNotificationsAsync() { | CODE |
| LOW | scripts/bump-package.ts | 62 | function findHighestVersionInLockfile(packageName: string): string | null { | CODE |
| LOW | scripts/bump-package.ts | 82 | function handleMinimumReleaseAgeError(output: string): void { | CODE |
| LOW | scripts/authorizeVercelDeploys.ts | 49 | function extractJobInfoFromTargetUrl(targetUrl: string): JobInfo { | CODE |
| LOW | scripts/waitForVercelPreview.js | 23 | function deploymentIdFromTargetUrl(targetUrl) { | CODE |
| LOW | scripts/waitForVercelPreview.js | 96 | async function resolveFromEarlierCommits(clients, { headSha, prNumber, statusContext, log }) { | CODE |
| LOW | packages/ui/src/components/shadcn/ui/chart.tsx | 300 | function getPayloadConfigFromPayload(config: ChartConfig, payload: unknown, key: string) { | CODE |
| LOW | packages/ui-patterns/src/FilterBar/utils.ts | 292 | export function updateNestedLogicalOperator(group: FilterGroup, path: number[]): FilterGroup { | CODE |
| LOW | …s/ui-patterns/src/CommandMenu/api/CommandMenuInput.tsx | 14 | function useFocusInputOnWiderScreens(ref: React.ForwardedRef<HTMLInputElement>) { | CODE |
| LOW | …rns/src/CommandMenu/api/hooks/useCrossCompatRouter.tsx | 13 | function useCrossCompatRouterContext() { | CODE |
| LOW | …mmandMenu/api/hooks/useCommandMenuTelemetryContext.tsx | 14 | export function useCommandMenuTelemetryContext() { | CODE |
| LOW | …rc/SqlToRest/syntax-highlighter/transform-renderer.tsx | 237 | function elementToRendererElementNode( | CODE |
| LOW | packages/common/first-referrer-cookie.ts | 214 | export function serializeFirstReferrerCookie(data: FirstReferrerData): string { | CODE |
| LOW | packages/common/sentry.ts | 12 | export function isSentryErrorBoundaryCrash(event: SentryEventTags): boolean { | CODE |
| LOW | packages/common/consented-url-cookie.ts | 109 | export function createConsentedUrlCookieSync() { | CODE |
| LOW | packages/common/telemetry-utils.ts | 4 | export function getTelemetryCookieOptions() { | CODE |
| LOW | packages/common/posthog-client.ts | 45 | export function buildSessionRecordingConfig( | CODE |
| LOW | packages/common/page-telemetry.ts | 7 | function getFirstTouchAttributionProps(telemetryData: SharedTelemetryData) { | CODE |
| LOW | packages/common/safe-storage.test.ts | 47 | function installUnavailableStorage(name: StorageName) { | CODE |
| LOW | packages/common/enabled-features/overrides.ts | 28 | export function getEnabledFeaturesOverrideDisabledList( | CODE |
| LOW | packages/pg-meta/test/db/utils.ts | 87 | export async function createDatabaseWithAuthSchema( | CODE |
| LOW | packages/pg-meta/src/helpers.ts | 36 | export function exceptionIdentifierNotFound(entityName: string, whereClause: string) { | CODE |
| LOW | packages/pg-meta/src/query/table-row-query.ts | 94 | export function formatPatternMatchFilterValue( | CODE |
| LOW | packages/pg-meta/src/sql/studio/role-impersonation.ts | 3 | function getPostgrestRoleImpersonationSql({ | CODE |
| LOW | packages/pg-meta/src/sql/studio/role-impersonation.ts | 19 | function getCustomRoleImpersonationSql(roleName: string): SafeSqlFragment { | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/privileges.ts | 238 | export function getExposedFunctionCountsSql({ | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/privileges.ts | 262 | export function getDefaultPrivilegesStateSql({ | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/privileges.ts | 283 | export function buildDefaultPrivilegesSql(action: 'grant' | 'revoke'): SafeSqlFragment { | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/fdw.ts | 113 | function buildCreateForeignTableSql( | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/fdw.ts | 140 | function buildRenameForeignTableSql( | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/fdw.ts | 201 | function buildAlterForeignTableSql( | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/fdw.ts | 287 | export function getCreateForeignDataWrapperSql( | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/fdw.ts | 431 | function createImportForeignSchemaSql(): SafeSqlFragment { | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/fdw.ts | 723 | export function getImportForeignSchemaSql({ | CODE |
| LOW | packages/pg-meta/src/sql/studio/database/triggers.ts | 14 | export function getDatabaseTriggerUpdateSQL({ | CODE |
| LOW | e2e/studio/utils/wait-for-response.ts | 116 | export async function waitForSchemaVisualizerToLoad(page: Page, ref: string, schema?: string) { | CODE |
| LOW | e2e/studio/utils/realtime-helpers.ts | 4 | export async function navigateToRealtimeInspector(page: Page, ref: string) { | CODE |
| LOW | e2e/studio/utils/filter-bar-helpers.ts | 53 | export async function addFilterWithDropdownValue( | CODE |
| LOW | e2e/studio/utils/wait-for-response-with-timeout.ts | 13 | export async function waitForApiResponseWithTimeout( | CODE |
| LOW | e2e/docs/utils/resolve-docs-scope.ts | 32 | async function assertFederatedSectionsInSync(repoRoot: string): Promise<void> { | CODE |
| LOW | e2e/docs/utils/resolve-docs-scope.ts | 101 | function partialRelPathFromChangedFile(filePath: string): string | null { | CODE |
| LOW | apps/studio/vite.config.ts | 378 | function workersFollowClientAssetsDir(): Plugin { | CODE |
| LOW | apps/studio/compat/sentry-nextjs.ts | 40 | export function captureRouterTransitionStart(_href: string, _navigationType: string): void {} | CODE |
| LOW | apps/studio/compat/next/router.ts | 119 | export function resolveSearchOrHashOnlyTarget(to: string, currentPathname: string): string { | CODE |
| LOW | apps/studio/compat/next/navigation.ts | 114 | export function useSelectedLayoutSegments(_parallelRouteKey?: string): string[] { | CODE |
| LOW | …nization/TeamSettings/InviteMemberButton.utils.test.ts | 172 | function makeEmailListSpaceSeparated(count: number): string { | CODE |
| LOW | apps/studio/tests/lib/branch-test-utils.ts | 66 | export function mockParentProjectPermissions(permissions: FgaPermissions[]) { | CODE |
| LOW | …s/pages/project/[ref]/settings/infrastructure.test.tsx | 146 | function mockInfrastructureEndpoints() { | CODE |
| LOW | apps/studio/state/metrics-preview.ts | 10 | export function getMemoryCommitmentPreview( | CODE |
| LOW | apps/studio/state/metrics-preview.ts | 17 | export function setMemoryCommitmentPreview(projectRef: string, preview: MemoryCommitmentPreview) { | CODE |
| LOW | apps/studio/state/metrics-preview.ts | 32 | export function useMemoryCommitmentPreview(projectRef: string | undefined) { | CODE |
| LOW | apps/studio/state/table-editor-operation-queue.types.ts | 113 | export function isEditCellContentOperation(op: QueuedOperation): op is EditCellContentOperation { | CODE |
| LOW | apps/studio/state/database-settings.tsx | 5 | export function createDatabaseSettingsState() { | CODE |
| LOW | apps/studio/state/database-settings.tsx | 36 | export function useDatabaseSettingsStateSnapshot(options?: Parameters<typeof useSnapshot>[1]) { | CODE |
| LOW | apps/studio/state/database-selector.tsx | 5 | export function createDatabaseSelectorState() { | CODE |
| LOW | apps/studio/state/database-selector.tsx | 32 | export function useDatabaseSelectorStateSnapshot(options?: Parameters<typeof useSnapshot>[1]) { | CODE |
| 723 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | docker/tests/test-self-hosted.sh | 117 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-self-hosted.sh | 119 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-self-hosted.sh | 129 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-self-hosted.sh | 131 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 94 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 96 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 206 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 208 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 222 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 224 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 258 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 260 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 352 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 354 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 447 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 449 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 478 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 480 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 500 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 502 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 518 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 520 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 551 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-self-hosted.sh | 553 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 94 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 96 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 103 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 105 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 128 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 130 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 140 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 142 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 151 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 153 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 163 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 165 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 175 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3.sh | 177 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 191 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 193 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 204 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 206 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 229 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 231 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 247 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 249 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 263 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 265 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 278 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 280 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 291 | # --------------------------------------------- | COMMENT |
| MEDIUM | docker/tests/test-s3.sh | 293 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3-backend.sh | 152 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3-backend.sh | 154 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3-backend.sh | 164 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3-backend.sh | 166 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3-backend.sh | 175 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3-backend.sh | 177 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3-backend.sh | 187 | # --------------------------------------------- | COMMENT |
| MEDIUM⚡ | docker/tests/test-s3-backend.sh | 189 | # --------------------------------------------- | COMMENT |
| 80 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker/setup.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/run.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/run.sh | 21 | # sh run.sh recreate --except <svc>... # force-recreate all services except the named ones | COMMENT |
| LOW | docker/update.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/update.sh | 21 | # | COMMENT |
| LOW | docker/update.sh | 41 | # -> build manifest gate -> confirm_gate (before any writes) | COMMENT |
| LOW | docker/docker-compose.envoy.yml | 1 | # DEPRECATED: Envoy is now the default API gateway defined directly in | COMMENT |
| LOW | docker/docker-compose.pg15.yml | 1 | # Postgres 15 override for self-hosted Supabase. | COMMENT |
| LOW | docker/docker-compose.pg17.yml | 1 | # Postgres 17 override for self-hosted Supabase. | COMMENT |
| LOW | docker/docker-compose.yml | 181 | # GOTRUE_EXTERNAL_GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID} | COMMENT |
| LOW | docker/docker-compose.yml | 201 | COMMENT | |
| LOW | docker/docker-compose.yml | 221 | # GOTRUE_SAML_ALLOW_ENCRYPTED_ASSERTIONS: ${SAML_ALLOW_ENCRYPTED_ASSERTIONS} | COMMENT |
| LOW | docker/docker-compose.pgbouncer.yml | 1 | # PgBouncer override for self-hosted Supabase | COMMENT |
| LOW | docker/tests/test-self-hosted.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/tests/test-self-hosted.sh | 221 | COMMENT | |
| LOW | docker/tests/test-update.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/tests/test-s3.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/tests/test-s3-backend.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/tests/test-auth-keys.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/tests/test-pg17-upgrade.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/tests/docker-compose.s3.test.yml | 1 | # Test override: exposes the S3 backend port for direct testing. | COMMENT |
| LOW | docker/tests/test-upgrades-manifest.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/utils/upgrade-pg17.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | docker/utils/upgrade-pg17.sh | 21 | # Backup: | COMMENT |
| LOW | docker/utils/upgrade-pg17.sh | 641 | 17.*) ;; | COMMENT |
| LOW | docker/utils/upgrade-pg17.sh | 661 | # - 20260413000000_fix-authenticator-session-preload-libraries.sql | COMMENT |
| LOW | docker/utils/upgrade-pg17.sh | 721 | # extensions only get updated to .063's versions. The final image ships newer | COMMENT |
| LOW | docker/utils/rotate-new-api-keys.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/utils/reassign-owner.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/utils/db-passwd.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/utils/add-new-auth-keys.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/utils/generate-keys.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/volumes/api/kong.yml | 361 | end | COMMENT |
| LOW | docker/volumes/api/kong.yml | 421 | ## Not used - Studio and Vector talk directly to analytics via Docker networking. | COMMENT |
| LOW | docker/volumes/api/kong-entrypoint.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/volumes/api/envoy/lds.template.yaml | 661 | #rbac: | COMMENT |
| LOW | supabase/config.toml | 81 | # enabled = true | COMMENT |
| LOW | supabase/functions/common/helpers.ts | 21 | hour: 'numeric', | COMMENT |
| LOW | examples/database/employees/supabase/config.toml | 1 | # For detailed configuration reference documentation, visit: | COMMENT |
| LOW | …amples/todo-list/nextjs-todo-list/supabase/config.toml | 61 | # If enabled, users need to confirm their email address before signing in. | COMMENT |
| LOW | …amples/todo-list/nextjs-todo-list/supabase/config.toml | 81 | # admin_email = "admin@email.com" | COMMENT |
| LOW | examples/todo-list/sveltejs-todo-list/src/vite-env.d.ts | 1 | /// <reference types="svelte" /> | COMMENT |
| LOW | examples/auth/hono-full/supabase/config.toml | 61 | # Port to use for Supabase Studio. | COMMENT |
| LOW | examples/auth/hono-full/supabase/config.toml | 81 | enabled = true | COMMENT |
| LOW | examples/auth/hono-full/supabase/config.toml | 101 | # A list of *exact* URLs that auth providers are permitted to redirect to post authentication. | COMMENT |
| LOW | examples/auth/hono-full/supabase/config.toml | 141 | # enabled = true | COMMENT |
| LOW | examples/auth/hono-full/supabase/config.toml | 161 | # Controls the minimum amount of time that must pass before sending another sms otp. | COMMENT |
| LOW | examples/auth/hono-full/supabase/config.toml | 241 | # user_pool_id = "my-user-pool-id" | COMMENT |
| LOW | examples/auth/hono-full/src/database.types.ts | 1 | // Replace this file by running: | COMMENT |
| LOW | examples/auth/sveltekit/src/database.types.ts | 1 | // Replace this file by running: | COMMENT |
| LOW | examples/auth/sveltekit-full/src/database.types.ts | 1 | // Replace this file by running: | COMMENT |
| LOW | examples/auth/hono/src/database.types.ts | 1 | // Replace this file by running: | COMMENT |
| LOW | examples/auth/nextjs/lib/supabase/proxy.ts | 61 | // myNewResponse.cookies.setAll(supabaseResponse.cookies.getAll()) | COMMENT |
| LOW | examples/auth/nextjs-full/supabase/config.toml | 81 | # Allows refresh tokens to be reused after expiry, up to the specified interval in seconds. | COMMENT |
| LOW | examples/auth/nextjs-full/lib/supabase/proxy.ts | 61 | // myNewResponse.cookies.setAll(supabaseResponse.cookies.getAll()) | COMMENT |
| LOW | …/auth/flutter-native-google-auth/analysis_options.yaml | 1 | # This file configures the analyzer, which statically analyzes Dart code to | COMMENT |
| LOW | …/auth/flutter-native-google-auth/analysis_options.yaml | 21 | # or a specific dart file by using the `// ignore: name_of_lint` and | COMMENT |
| LOW | examples/auth/flutter-mfa/analysis_options.yaml | 1 | # This file configures the analyzer, which statically analyzes Dart code to | COMMENT |
| LOW | examples/auth/flutter-mfa/analysis_options.yaml | 21 | # or a specific dart file by using the `// ignore: name_of_lint` and | COMMENT |
| LOW | examples/storage/protomaps/supabase/config.toml | 21 | enabled = true | COMMENT |
| 133 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/safe-sql-execution/SKILL.md | 89 | InputProps, 'placeholder' | 'value' | 'onChange' | CODE |
| LOW | examples/todo-list/nextjs-todo-list/pages/api/hello.ts | 9 | res.status(200).json({ name: 'John Doe' }) | CODE |
| LOW | …edge-functions/supabase/functions/oak-server/README.md | 17 | --data-raw '{ "name": "John Doe" }' | CODE |
| LOW | …ng/with-nextjs-13-server-components/pages/api/hello.ts | 9 | res.status(200).json({ name: 'John Doe' }) | CODE |
| LOW | examples/caching/with-nextjs-13/pages/api/hello.ts | 9 | res.status(200).json({ name: 'John Doe' }) | CODE |
| LOW | packages/ui/src/lib/MarkdownSample.md | 71 | Contrary to popular belief, Lorem Ipsum is not simply random text. It has roots in a piece of | CODE |
| LOW | packages/pg-meta/test/db/00-init.sql | 18 | ('Jane Doe'); | CODE |
| LOW | packages/pg-meta/test/query/table-row-query.test.ts | 1428 | ('Small text', repeat('Lorem ipsum ', 100), '{"key": "value", "nested": {"data": true}}'), | CODE |
| LOW | packages/pg-meta/test/query/table-row-query.test.ts | 1429 | ('Another small text', repeat('Dolor sit amet ', 100), '{"array": [1, 2, 3], "bool": false}'); | CODE |
| LOW | packages/pg-meta/test/query/table-row-query.test.ts | 1474 | expect(queryResult[0].large_text.startsWith('Lorem ipsum')).toBe(true) | CODE |
| LOW | packages/pg-meta/test/query/table-row-query.test.ts | 1475 | expect(queryResult[1].large_text.startsWith('Dolor sit amet')).toBe(true) | CODE |
| LOW | packages/pg-meta/test/query/advanced-query.test.ts | 64 | ('John Doe'), | CODE |
| LOW | packages/pg-meta/test/query/advanced-query.test.ts | 347 | (12, 'John Doe'), | CODE |
| LOW⚡ | packages/pg-meta/test/query/advanced-query.test.ts | 368 | expect(result[0].name).toBe('John Doe') // Alphabetically first | CODE |
| LOW⚡ | packages/pg-meta/test/query/advanced-query.test.ts | 378 | .insert([{ name: 'John Doe' }], { returning: true }) | CODE |
| LOW⚡ | packages/pg-meta/test/query/advanced-query.test.ts | 382 | `"insert into public.normal_table (name) select name from jsonb_populate_recordset(null::public.normal_table, '[ | CODE |
| LOW⚡ | packages/pg-meta/test/query/advanced-query.test.ts | 387 | expect(result[0].name).toBe('John Doe') | CODE |
| LOW | packages/pg-meta/test/query/advanced-query.test.ts | 453 | VALUES ('John Smith'), ('John Doe'), ('Jane Doe'); | CODE |
| LOW | packages/pg-meta/test/query/advanced-query.test.ts | 453 | VALUES ('John Smith'), ('John Doe'), ('Jane Doe'); | CODE |
| LOW | …es/pg-meta/test/sql/studio/get-users-paginated.test.ts | 101 | ('${searchUserId}', 'john.doe@supabase.io', NULL, '00000000-0000-0000-0000-000000000000', '{"full_name": "John Doe | CODE |
| LOW | .github/workflows/docs-tests.yml | 91 | echo "GITHUB_CLIENT_ID=dummy-id" >> .env | CODE |
| LOW | e2e/studio/utils/auth-helpers.ts | 16 | await page.getByRole('textbox', { name: 'user@example.com' }).fill(email) | CODE |
| LOW | …nization/TeamSettings/InviteMemberButton.utils.test.ts | 15 | expect(parseEmails('user@example.com')).toStrictEqual(['user@example.com']) | CODE |
| LOW | …nization/TeamSettings/InviteMemberButton.utils.test.ts | 178 | expect(emailSchema.safeParse('user@example.com').success).toBe(true) | CODE |
| LOW | …/Organization/TeamSettings/InviteMemberButton.test.tsx | 349 | target: { value: 'admin@example.com' }, | CODE |
| LOW | …/Organization/TeamSettings/InviteMemberButton.test.tsx | 358 | expect(invitePayloads[0]).toEqual({ emails: ['admin@example.com'], role_id: roleId }) | CODE |
| LOW | …components/Billing/useBillingCustomerDataForm.test.tsx | 38 | billing_name: 'Acme Inc', | CODE |
| LOW | …components/Billing/useBillingCustomerDataForm.test.tsx | 40 | line1: '123 Main St', | CODE |
| LOW | …components/Billing/useBillingCustomerDataForm.test.tsx | 225 | billing_name: 'Acme Inc', | CODE |
| LOW | …components/Billing/useBillingCustomerDataForm.test.tsx | 264 | name: 'Acme Inc', | CODE |
| LOW | …components/Billing/useBillingCustomerDataForm.test.tsx | 277 | billing_name: 'Acme Inc', | CODE |
| LOW | …components/Billing/useBillingCustomerDataForm.test.tsx | 522 | name: 'Acme Inc', | CODE |
| LOW | …components/Billing/useBillingCustomerDataForm.test.tsx | 535 | billing_name: 'Acme Inc', | CODE |
| LOW | apps/studio/components/ui/SafeSqlInput.tsx | 7 | export type SafeSqlInputProps = Omit<InputProps, 'placeholder' | 'value' | 'onChange'> & { | CODE |
| LOW | …rganization/OAuthApps/OAuthAppsAuthorizedList.test.tsx | 56 | await userEvent.click(await screen.findByText('admin@example.com')) | CODE |
| LOW | …nents/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts | 52 | const { params } = parse(buildUnifiedLogsUrl({ projectRef: 'abc', user: 'user@example.com' })) | CODE |
| LOW | …nents/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts | 53 | expect(params.get('user')).toBe('user@example.com') | CODE |
| LOW | …nents/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts | 356 | user: 'user@example.com', | CODE |
| LOW | …nents/interfaces/UnifiedLogs/UnifiedLogs.utils.test.ts | 373 | user: 'user@example.com', | CODE |
| LOW | …tinationPanel/DestinationForm/DestinationForm.utils.ts | 381 | ? { accessKey: 'placeholder', secretKey: 'placeholder' } | CODE |
| LOW | …/components/interfaces/Auth/SmtpForm/SmtpForm.test.tsx | 33 | SMTP_ADMIN_EMAIL: 'admin@example.com', | CODE |
| LOW | …o/components/interfaces/Auth/Users/CreateUserModal.tsx | 94 | placeholder="user@example.com" | CODE |
| LOW | …ents/interfaces/Auth/Users/UserPanel.platform.test.tsx | 23 | email: 'user@example.com', | CODE |
| LOW | …tomAuthProviders/CreateOrUpdateCustomProviderSheet.tsx | 132 | client_secret: 'placeholder', | CODE |
| LOW | …tomAuthProviders/CreateOrUpdateCustomProviderSheet.tsx | 144 | client_secret: 'placeholder', | CODE |
| LOW | …tomAuthProviders/CreateOrUpdateCustomProviderSheet.tsx | 200 | if (values.client_secret !== 'placeholder') { | CODE |
| LOW | …es/OrganizationInvite/OrganizationInvite.utils.test.ts | 16 | organization_name: 'Acme Corp', | CODE |
| LOW | …erfaces/OrganizationInvite/OrganizationInvite.test.tsx | 68 | organization_name: 'Acme Corp', | CODE |
| LOW | …es/Account/Preferences/AccountIdentities.utils.test.ts | 32 | const email = 'user@example.com' | CODE |
| LOW | …erfaces/Account/Preferences/AccountIdentities.test.tsx | 44 | const EMAIL = 'user@example.com' | CODE |
| LOW | …erfaces/Account/AccessTokens/AccessToken.roles.test.ts | 318 | organizations: [{ ...ORG, name: 'Acme Corp' }], | CODE |
| LOW | …erfaces/Account/AccessTokens/AccessToken.roles.test.ts | 328 | label: 'Acme Corp', | CODE |
| LOW | …udio/components/grid/utils/queueOperationUtils.test.ts | 118 | row: { id: 1, email: 'test@test.com' }, | CODE |
| LOW | …udio/components/grid/utils/queueOperationUtils.test.ts | 119 | identifiers: { id: 1, email: 'test@test.com' }, | CODE |
| LOW | …udio/components/grid/utils/queueOperationUtils.test.ts | 137 | identifiers: { id: 1, email: 'test@test.com' }, | CODE |
| LOW | …io/public/monaco-editor/vs/language/html/htmlWorker.js | 440 | **Note:** Do not use this attribute, as it is non-standard and only implemented in some versions of Microsoft Internet E | CODE |
| LOW | …udio/public/monaco-editor/vs/base/worker/workerMain.js | 29 | `||e===" "}}),X(J[69],Z([0,1]),function(W,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.WrappingInd | CODE |
| LOW | apps/studio/lib/session-replay.test.ts | 59 | ['placeholder', 'Search in customer-invoices...'], | CODE |
| LOW | apps/studio/lib/session-replay.test.ts | 196 | expect(maskReplayAttribute('placeholder', storageSearch)).toBe('*') | CODE |
| LOW | apps/studio/lib/session-replay.test.ts | 199 | expect(maskReplayAttribute('placeholder', authCallback)).toBe('*') | CODE |
| 58 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 93 | print("Connection successful!") | CODE |
| HIGH⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 101 | print("Current Time:", result) | CODE |
| HIGH⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 106 | print("Connection closed.") | CODE |
| HIGH⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 109 | print(f"Failed to connect: {e}")`, | CODE |
| HIGH⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 145 | print("Connection successful!") | CODE |
| HIGH⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 147 | print(f"Failed to connect: {e}")`, | CODE |
| HIGH⚡ | …es/ConnectSheet/content/steps/direct-files/content.tsx | 209 | print("Connection successful!") | CODE |
| HIGH⚡ | …es/ConnectSheet/content/steps/direct-files/content.tsx | 211 | print(f"Failed to connect: {e}")`, | CODE |
| HIGH | …tails/CreateTable/CreateTableInstructions.constants.ts | 57 | print("Creating catalog 'default'...") | CODE |
| HIGH⚡ | …tails/CreateTable/CreateTableInstructions.constants.ts | 68 | print("Creating table 'events'...") | CODE |
| HIGH⚡ | …tails/CreateTable/CreateTableInstructions.constants.ts | 72 | print("Preparing sample data to be inserted...") | CODE |
| HIGH⚡ | …tails/CreateTable/CreateTableInstructions.constants.ts | 81 | print("Inserting data into 'events'...") | CODE |
| HIGH⚡ | …tails/CreateTable/CreateTableInstructions.constants.ts | 84 | print("Completed!") | CODE |
| HIGH⚡ | …tails/CreateTable/CreateTableInstructions.constants.ts | 87 | print(df) | CODE |
| HIGH | apps/docs/features/directives/CodeSample.test.ts | 232 | print(f"add_numbers(3, 5) = {result1}") # Expected output: 8 | CODE |
| HIGH | apps/docs/features/directives/CodeSample.test.ts | 451 | print(f"add_numbers(3, 5) = {result1}") # Expected output: 8 | CODE |
| HIGH | apps/docs/features/directives/CodeSample.test.ts | 750 | print(f"add_numbers(3, 5) = {result1}") # Expected output: 8 | CODE |
| HIGH | apps/www/app/(products)/auth/_components/ApiSection.tsx | 294 | print(event, session) | CODE |
| HIGH | …stem/registry/default/example/markdown-code-blocks.tsx | 12 | print("Hello, World!") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker/volumes/api/kong.yml | 373 | ## alike), so unknown/invalid keys simply pass to the runtime, which handles | COMMENT |
| MEDIUM | .github/workflows/braintrust-evals.yml | 17 | # Cheap, always-on gate: verifies the eval harness can reach the MCP server | COMMENT |
| MEDIUM | .github/workflows/docs-e2e.yml | 128 | # Vercel skips the docs preview when a PR only changes the harness | COMMENT |
| MEDIUM | .github/workflows/kb-e2e.yml | 70 | # Vercel skips the kb preview when a PR only changes the harness, so wait | COMMENT |
| MEDIUM | .github/workflows/www-e2e.yml | 122 | # Vercel skips the preview when only the harness changed, so wait for one | COMMENT |
| MEDIUM | .github/workflows/studio-e2e-test.yml | 95 | # See here for caching with `yarn`, `bun` or other package managers https://github.com/actions/cache/blob/main | COMMENT |
| MEDIUM | .github/workflows/studio-e2e-test.yml | 95 | # See here for caching with `yarn`, `bun` or other package managers https://github.com/actions/cache/blob/main | COMMENT |
| MEDIUM | …eamSettings/UpdateRolesPanel/UpdateRolesPanel.utils.ts | 106 | // [Joshen] Essentially spit out 3 arrays | COMMENT |
| MEDIUM | …ridEditor/SidePanelEditor/RowEditor/RowEditor.utils.ts | 143 | // [Joshen] Definitely can find a better way to parse the description, but this suffices for now | COMMENT |
| MEDIUM | …udio/public/monaco-editor/vs/language/css/cssWorker.js | 73 | This is used to produce an effect that is known as tate-ch\u016B-yoko (\u7E26\u4E2D\u6A2A) in Japanese, or as \u76F4\u66 | CODE |
| MEDIUM | …io/public/monaco-editor/vs/language/html/htmlWorker.js | 259 | * To learn about this declaration in Firefox for Mobile, see [this article](https://developer.mozilla.org/en-US/do | COMMENT |
| MEDIUM | …io/public/monaco-editor/vs/language/html/htmlWorker.js | 270 | Default mode, which indicates no preference for the decoding mode. The browser decides what is best for the user.`}},{na | CODE |
| MEDIUM | …io/public/monaco-editor/vs/language/html/htmlWorker.js | 270 | Default mode, which indicates no preference for the decoding mode. The browser decides what is best for the user.`}},{na | CODE |
| MEDIUM | …io/public/monaco-editor/vs/language/html/htmlWorker.js | 288 | **Note**: Sites that automatically play audio (or videos with an audio track) can be an unpleasant experience for users, | CODE |
| MEDIUM | apps/studio/pages/api/ai/code/complete.ts | 219 | // avoids fetching DDL for table aliases or other false matches. This is robust to | COMMENT |
| MEDIUM | apps/docs/scripts/search/sources/lint-warnings-guide.ts | 124 | return `# Database Advisor: Lint ${this.lint.path}\n\nThis is a database lint rule for Supabase, targeting the lint | CODE |
| MEDIUM | …/state-of-startups/components/ParticipantsCarousel.tsx | 48 | // Duplicate so the loop is seamless: translateX(-50%) lands the start of | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sitemaps/json_output/youtube_videos.json | 907 | "title": "Don't forget to switch this off if using Drizzle!", | CODE |
| MEDIUM | examples/auth/nextjs/proxy.ts | 15 | * Feel free to modify this pattern to include more paths. | COMMENT |
| MEDIUM | examples/auth/nextjs-full/proxy.ts | 15 | * Feel free to modify this pattern to include more paths. | COMMENT |
| MEDIUM | examples/realtime/nextjs-authorization-demo/proxy.ts | 16 | * Feel free to modify this pattern to include more paths. | COMMENT |
| MEDIUM | …amples/user-management/nextjs-user-management/proxy.ts | 16 | * Feel free to modify this pattern to include more paths. | COMMENT |
| MEDIUM | packages/ui/src/lib/Hooks.tsx | 30 | // It's worth noting that because passed in handler is a new ... | COMMENT |
| LOW | …udio/public/monaco-editor/vs/language/css/cssWorker.js | 32 | `),[{language:"html",value:r}]}doPrint(e,t){for(let r of e)this.doPrintElement(r,t),r.children&&this.doPrint(r.children, | CODE |
| MEDIUM | …io/public/monaco-editor/vs/language/html/htmlWorker.js | 306 | **Usage note:** Do not use this attribute, as it has been deprecated. The [\`<caption>\`](https://developer.mozilla.org/ | CODE |
| MEDIUM | …pts/__snapshots__/build-reference-content.dart.v2.json | 3457 | "notes": "- Before you can call this method you need to [establish a connection](/docs/guides/auth/sso/auth-sso-sa | CODE |
| MEDIUM | apps/ui-library/public/r/social-auth-nextjs.json | 47 | "content": "import { type NextRequest } from 'next/server'\n\nimport { updateSession } from '@/registry/default/cl | CODE |
| MEDIUM | …ps/ui-library/public/r/password-based-auth-nextjs.json | 49 | "content": "import { type NextRequest } from 'next/server'\n\nimport { updateSession } from '@/registry/default/cl | CODE |
| MEDIUM | …gistry/default/blocks/social-auth-nextjs/middleware.ts | 16 | * Feel free to modify this pattern to include more paths. | COMMENT |
| MEDIUM | …efault/blocks/password-based-auth-nextjs/middleware.ts | 17 | * Feel free to modify this pattern to include more paths. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker/setup.sh | 15 | # Usage: | COMMENT |
| LOW | docker/docker-compose.logs.yml | 5 | # Usage: | COMMENT |
| LOW | docker/run.sh | 15 | # Usage: | COMMENT |
| LOW | docker/update.sh | 22 | # Usage: | COMMENT |
| LOW | docker/docker-compose.pg15.yml | 9 | # Usage: | COMMENT |
| LOW | docker/docker-compose.pgbouncer.yml | 5 | # Usage: | COMMENT |
| LOW | docker/tests/test-self-hosted.sh | 5 | # Usage: | COMMENT |
| LOW | docker/tests/test-container-logs.sh | 5 | # Usage: | COMMENT |
| LOW | docker/tests/test-update.sh | 18 | # Usage: | COMMENT |
| LOW | docker/tests/test-s3.sh | 9 | # Usage: | COMMENT |
| LOW | docker/tests/test-s3-backend.sh | 9 | # Usage: | COMMENT |
| LOW | docker/tests/test-auth-keys.sh | 5 | # Usage: | COMMENT |
| LOW | docker/tests/test-pg17-upgrade.sh | 8 | # Usage: | COMMENT |
| LOW | docker/tests/docker-compose.s3.test.yml | 3 | # Usage: | COMMENT |
| LOW | docker/tests/docker-compose.rustfs.test.yml | 3 | # Usage: | COMMENT |
| LOW | docker/tests/test-upgrades-manifest.sh | 17 | # Usage: | COMMENT |
| LOW | docker/utils/rotate-new-api-keys.sh | 8 | # Usage: | COMMENT |
| LOW | docker/utils/reassign-owner.sh | 11 | # Usage: | COMMENT |
| LOW | docker/utils/add-new-auth-keys.sh | 10 | # Usage: | COMMENT |
| LOW | docker/utils/generate-keys.sh | 8 | # Usage: | COMMENT |
| LOW | .agents/skills/test-the-docs/sandbox/run.sh | 4 | # Usage: | COMMENT |
| LOW | …ps/docs/app/guides/ai-tools/ai-prompts/[slug]/page.tsx | 28 | ## How to use | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | examples/prompts/use-realtime.md | 392 | ### Step 1: Replace Client Code | COMMENT |
| LOW | examples/prompts/use-realtime.md | 411 | ### Step 2: Add Database Trigger (Only if using broadcast) | COMMENT |
| LOW | examples/prompts/use-realtime.md | 419 | ### Step 3: Setup Authorization (Only if using broadcast) | COMMENT |
| LOW | e2e/studio/features/api-access-toggle.spec.ts | 269 | // Step 1: Create a table with API access on (default — full grants) | COMMENT |
| LOW | e2e/studio/features/api-access-toggle.spec.ts | 296 | // Step 2: Navigate back and edit only the description | COMMENT |
| LOW | e2e/studio/features/api-access-toggle.spec.ts | 324 | // Step 3: Verify the full privileges are unchanged after the description edit | COMMENT |
| LOW | e2e/studio/features/cron-jobs.spec.ts | 630 | // Step 1: Click "Delete rows now" to run the cleanup | COMMENT |
| LOW | …Integrations/CronJobs/CronJobsTab.useCleanupActions.ts | 77 | // Step 1: Get the total number of pages in the table | COMMENT |
| LOW | …Integrations/CronJobs/CronJobsTab.useCleanupActions.ts | 108 | // Step 2: Iterate through pages in batches | COMMENT |
| LOW⚡ | apps/studio/data/branches/branch-merge-mutation.ts | 22 | // Step 1: Get the diff output from the branch | COMMENT |
| LOW⚡ | apps/studio/data/branches/branch-merge-mutation.ts | 27 | // Step 2: If there are changes, create a migration before merging | COMMENT |
| LOW | apps/studio/data/branches/branch-merge-mutation.ts | 42 | // Step 3: Call POST /v1/branches/id/merge to merge the branch | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | e2e/studio/features/api-access-toggle.spec.ts | 269 | // Step 1: Create a table with API access on (default — full grants) | COMMENT |
| LOW | e2e/studio/features/api-access-toggle.spec.ts | 296 | // Step 2: Navigate back and edit only the description | COMMENT |
| LOW | e2e/studio/features/api-access-toggle.spec.ts | 324 | // Step 3: Verify the full privileges are unchanged after the description edit | COMMENT |
| LOW | e2e/studio/features/cron-jobs.spec.ts | 630 | // Step 1: Click "Delete rows now" to run the cleanup | COMMENT |
| LOW | …Integrations/CronJobs/CronJobsTab.useCleanupActions.ts | 77 | // Step 1: Get the total number of pages in the table | COMMENT |
| LOW | …Integrations/CronJobs/CronJobsTab.useCleanupActions.ts | 108 | // Step 2: Iterate through pages in batches | COMMENT |
| LOW⚡ | apps/studio/data/branches/branch-merge-mutation.ts | 22 | // Step 1: Get the diff output from the branch | COMMENT |
| LOW⚡ | apps/studio/data/branches/branch-merge-mutation.ts | 27 | // Step 2: If there are changes, create a migration before merging | COMMENT |
| LOW | apps/studio/data/branches/branch-merge-mutation.ts | 42 | // Step 3: Call POST /v1/branches/id/merge to merge the branch | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | apps/docs/spec/supabase_kt_v1.yml | 0 | content, from: sender_id(name), to: receiver_id(name) | STRING |
| HIGH | apps/docs/spec/supabase_kt_v2.yml | 0 | content, from: sender_id(name), to: receiver_id(name) | STRING |
| HIGH | apps/docs/spec/supabase_kt_v3.yml | 0 | content, from: sender_id(name), to: receiver_id(name) | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 95 | # Create a cursor to execute SQL queries | COMMENT |
| MEDIUM⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 136 | # Create the SQLAlchemy engine | COMMENT |
| MEDIUM⚡ | …es/ConnectSheet/content/steps/direct-files/content.tsx | 200 | # Create the SQLAlchemy engine | COMMENT |
| MEDIUM | …www/app/(products)/database/_components/ApiSection.tsx | 199 | Python: `# Create a room and its first message | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .agents/skills/test-the-docs/reference/sandbox-setup.md | 7 | ## Threat model and guardrails | COMMENT |
| MEDIUM | sitemaps/json_output/sitemap_www.json | 18 | "https://supabase.com/blog/agentic-coding-on-supabase-with-opencode", | CODE |
| MEDIUM | …ngs/Infrastructure/ReadReplicas/ReadReplicaDetails.tsx | 69 | // [Joshen] This is unused but intentional to scaffold the usage for now, refer to comment below | COMMENT |
| MEDIUM | …ditor/UtilityPanel/QuerySourceMenu/QuerySourceMenu.tsx | 81 | // `/sql/new` tab is a blank scaffold with nothing to preserve. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 108 | except Exception as e: | CODE |
| LOW⚡ | …s/interfaces/ConnectSheet/DirectConnectionExamples.tsx | 146 | except Exception as e: | CODE |
| LOW⚡ | …es/ConnectSheet/content/steps/direct-files/content.tsx | 210 | except Exception as e: | CODE |
| LOW | apps/docs/spec/supabase_py_v2.yml | 3773 | except Exception as exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | apps/www/data/surveys/state-of-startups-2026.tsx | 538 | title: 'What percentage of your codebase was generated by AI?', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/upload-static-assets.sh | 101 | # Check if directory exists | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | apps/docs/app/api/graphql/route.ts | 253 | async function handleRequest(request: Request): Promise<NextResponse> { | CODE |