supabase-data-design

Designs Postgres and Supabase schemas with row-level security, naming conventions, and tables-versus-JSON decisions.

1|Updated Jun 3, 2026
One-click install
npx skills add https://github.com/tanveerriaz/Skillz --skill supabase-data-design-tanveerriaz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supabase-data-design
Source: https://github.com/tanveerriaz/Skillz/tree/main/skills/supabase-data-design
Command: npx skills add https://github.com/tanveerriaz/Skillz --skill supabase-data-design-tanveerriaz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams building on Postgres or Supabase often ship tables without row-level security, apply inconsistent naming, or misuse JSON columns for data that later needs filtering. This Skill provides concrete defaults for schema design so the data layer stays secure, consistent, and queryable. ## Core Features & Use Cases - Secure-by-default schema design: Enforces row-level security with explicit policies on every user or tenant table, and keeps the service-role key server-side only. - Tables vs. JSON decision guidance: Helps decide when normalized columns are required versus when a JSON document store is appropriate, based on query patterns. - Naming, relationships, and indexing standards: Applies one consistent naming convention, correct foreign keys and cardinality, and indexes aligned to real filter and join patterns. - Use Case: When creating a new multi-tenant SaaS schema on Supabase, use this Skill to define tables with RLS policies scoped per tenant, proper foreign keys, and versioned migration scripts. ## Quick Start Use the supabase-data-design skill to design a schema for my app's users, projects, and billing tables with row-level security enabled.

Frequently Asked Questions about supabase-data-design

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I design a Supabase database schema with row-level security?▼

Enable row-level security on every table holding user or tenant data, then write explicit policies defining who can read and write each row. Combine this with consistent naming, foreign keys, and indexes matched to your query patterns.

When should I use JSON columns vs normalized tables in Postgres?▼

Use normalized tables and columns when you filter, join, aggregate, or enforce constraints on the fields. Use JSON storage for flexible, schema-variable payloads read as a whole, such as raw API responses or per-record metadata you never query field-by-field.

How do I handle multi-tenant data isolation in Supabase?▼

Scope every query by tenant using RLS policies so each tenant can only access its own rows. Test explicitly that one tenant cannot read another tenant's data before shipping.

Why is exposing the Supabase service-role key dangerous?▼

The service-role key bypasses all row-level security policies, so exposing it client-side gives anyone full access to your database. Keep it backend-only and never ship it to the browser or frontend code.

What are the limitations of storing everything in a JSON blob?▼

JSON blobs cannot be efficiently filtered, joined, or constrained, so data you later need to query by field becomes painful to work with. Migrate hot fields into real columns once query patterns stabilize.