Before you launch a Supabase + Next.js app: 8 checks that take an hour

Tutorials get your app running. These eight checks help make it safer before real users arrive.

1. RLS is enabled on every table in the public schema, with at least one policy that matches how the table is used.
2. The service role key stays on the server. Never expose it in client code or in a variable that starts with NEXT_PUBLIC_.
3. Auth redirect URLs list your production domain, and the Site URL is correct.
4. Custom SMTP is set up. The default email sender has strict limits and is not meant for production traffic.
5. Stripe webhooks verify the signature using the raw request body, and handlers are idempotent.
6. Indexes exist on the columns your RLS policies and frequent queries filter by.
7. Storage buckets have policies that match who may read and write each path.
8. Errors are tracked and you separate dev and production projects.

The full list

The Supabase + Next.js Production Readiness Checklist has 84 prioritized checks (Critical, High, Medium). For the complete path see the Start here collection. 14-day money-back guarantee on every purchase.