supabase

A Supabase project: edge functions under Deno. Every storage bucket has a policy, and privileged keys stay in their allowed files. It requires postgres, javascript.

Checks

Check	Stage	Level	What it does
supabase/storage-policies	commit	recommended	Checks that every storage bucket in the project file has a policy on storage.objects that names it.
supabase/service-role-key	commit	recommended	Checks that only edge functions and test files name a secret or service role key.
supabase/deno-lint	commit	recommended	Runs deno lint over every edge function with its own deno.json.
supabase/deno-check	push	recommended	Runs deno check on the entry file of every edge function.
supabase/stale-types	push	recommended	Compares supabase.types_file with the output the Supabase CLI writes from the local database.

Settings

Setting	What it sets
supabase.functions_folder	The folder, relative to the repository root, with one folder for each edge function; the default starts from the project scope.
supabase.schemas	The database schemas to include in generated types.
supabase.types_file	The committed database types file, relative to the repository root; without it, no type comparison runs.

Selected when

gspot selects it in a scope with file paths **/supabase/config.toml, or project files supabase/config.toml.

Defaults set for other configurations

Setting	Value
postgres.client_schemas	["public"]
tools.squawk.assume_in_transaction	true

Rules for coding agents

Rule file	Installed when
.gspot/configurations/platform/supabase/rules/SUPABASE.md	Always

Tools and versions

Tool	Version
deno	2.6.6
supabase	Any

Files gspot writes

gspot writes .gspot/configurations/platform/supabase/semgrep.yml (with the security configuration).