# supabase

> A Supabase project: edge functions under Deno. Every storage bucket has a policy, and privileged keys stay in their allowed files.

A Supabase project: edge functions under Deno. Every storage bucket has a policy, and privileged keys stay in their allowed files. It requires [`postgres`](/reference/configurations/postgres/), [`javascript`](/reference/configurations/javascript/).

## Checks

| Check                                                                       | Stage    | Level         | What it does                                                                                        |
| --------------------------------------------------------------------------- | -------- | ------------- | --------------------------------------------------------------------------------------------------- |
| [`supabase/storage-policies`](/reference/checks/supabase/storage-policies/) | `commit` | `recommended` | Checks that every storage bucket in the project file has a policy on storage.objects that names it. |
| [`supabase/service-role-key`](/reference/checks/supabase/service-role-key/) | `commit` | `recommended` | Checks that only edge functions and test files name a secret or service role key.                   |
| [`supabase/deno-lint`](/reference/checks/supabase/deno-lint/)               | `commit` | `recommended` | Runs `deno lint` over every edge function with its own deno.json.                                   |
| [`supabase/deno-check`](/reference/checks/supabase/deno-check/)             | `push`   | `recommended` | Runs `deno check` on the entry file of every edge function.                                         |
| [`supabase/stale-types`](/reference/checks/supabase/stale-types/)           | `push`   | `recommended` | Compares `supabase.types_file` with the output the Supabase CLI writes from the local database.     |

## Settings

| Setting                                                                         | What it sets                                                                                                                    |
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| [`supabase.functions_folder`](/reference/gspot-toml/#supabase.functions_folder) | The folder, relative to the repository root, with one folder for each edge function; the default starts from the project scope. |
| [`supabase.schemas`](/reference/gspot-toml/#supabase.schemas)                   | The database schemas to include in generated types.                                                                             |
| [`supabase.types_file`](/reference/gspot-toml/#supabase.types_file)             | The committed database types file, relative to the repository root; without it, no type comparison runs.                        |

## Selected when

gspot selects it in a scope with file paths `**/supabase/config.toml`, or project files `supabase/config.toml`.

## Defaults set for other configurations

| Setting                              | Value        |
| ------------------------------------ | ------------ |
| `postgres.client_schemas`            | `["public"]` |
| `tools.squawk.assume_in_transaction` | `true`       |

## Rules for coding agents

| Rule file                                                   | Installed when |
| ----------------------------------------------------------- | -------------- |
| `.gspot/configurations/platform/supabase/rules/SUPABASE.md` | Always         |

## Tools and versions

| Tool     | Version |
| -------- | ------- |
| deno     | `2.6.6` |
| supabase | Any     |

## Files gspot writes

gspot writes `.gspot/configurations/platform/supabase/semgrep.yml` (with the [`security`](/reference/configurations/security/) configuration).