The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Excited to share some of the backend work I've been doing lately with Supabase! 🚀
Here's a look at what went into building a production-ready backend from scratch:
🗄️ Database Schema Design
Designed a relational schema with multiple interconnected tables: profiles, notes, reminders, conflicts, and a dedicated user_keys table for encryption key management. Every table has proper foreign key relationships, timestamps, and nullable/non-nullable constraints enforced at the DB level.
🔒 Row Level Security (RLS)
Every single table has RLS enabled with two policies: users can only access their own rows, and anonymous access is blocked entirely. No exceptions. Security is enforced at the database layer, not just the application layer.
🔑 Auth & Email Flows
Set up Supabase Auth with email + OAuth support, including full PKCE flow for secure token exchange. Configured deep link redirects for email confirmation and password reset flows, all tested end to end.
⚡ Edge Functions
Built and deployed multiple Supabase Edge Functions handling AI processing pipelines, including JWT validation at the top of every function before any processing begins. The OpenAI API key lives exclusively in Supabase secrets, never in the app or any config file.
🔄 Merge Pipeline
Built a follow-up note merge pipeline as an Edge Function. New facts are appended to existing profiles, duplicates are detected and skipped, conflicts are logged, and resolved reminders are handled gracefully.
📦 Migrations
All schema changes go through versioned migration files under source control. No manual dashboard changes. CI/CD triggers migrations automatically on merge to main.
🔐 Encryption Architecture
Client-side AES-GCM encryption via CryptoKit. Plaintext never sits in the database. Encryption keys are stored in a dedicated RLS-scoped table, fetched after login, and held in memory only for the session duration.
Still a lot more to share about this project. Excited to talk about it publicly when it launches! 👀
Interesting work! Nice 🔥 Have there been any bottlenecks so far in testing?
Thank you! so far no bottlenecks, Supabase very smooth, you can easily verify how data stored from website or Postgres and for the edge functions with postman.
Yeah good choice using Supabase. It's the standard
Goo work, Supabase rocks!
Thank you 🙌
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
Same SAE-REN project. A new way to explore it.
I’ve reworked the case study to make the connections between the identity, packaging, and physical applications clearer.
I think this version finally strikes the balance I was looking for: explaining the design decisions and logic behind the system while making the full page a pleasure to explore.
Old or new, which version would make you keep exploring?
2 voted
15%
11 voted
85%
13 votes
Closed
New♥️
Project AIR is an open-source toolkit that keeps a tamper-proof record of what AI agents do. Every action an agent takes gets signed, chained to the step before it, and tied to the person who authorized it. The chain is anchored to Sigstore Rekor, a public transparency log, so anyone can check later that nothing was changed or deleted. When something goes wrong, you can show exactly what happened and who approved it, instead of just saying it happened.
It also runs 16 detectors over every record, covering all ten risks on the OWASP Top 10 for Agentic Applications, three from the OWASP list for LLM apps, and three of its own. It can stop an agent mid-action until a person signs off. It plugs into LangChain, LlamaIndex, and the OpenAI, Anthropic and Gemini SDKs with a line or two of code.
I built the Python library and command-line tool, published on PyPI as projectair (now at version 1.3.1) under the Apache 2.0 license, plus the website and dashboard in SvelteKit. We run it on our own infrastructure too: every request to vindicara.io is recorded and anchored to Rekor every minute.
Impressive work! 👏 Excellent approach to AI agent security, tamper-proof audit trails, and human oversight for more trustworthy AI systems.
My submission for the Base44 Challenge: Vantrix.
Instead of juggling separate platforms for crypto, forex, and commodities, Vantrix unifies multi-asset execution and real-time market insights into one clean workspace.
Key features built:
• Unified Asset Dashboard: Live tickers and market charting across crypto, forex, and commodities.
• AI Market Insights: Automated trend evaluation and signal highlights built into the feed.
• Execution Workflows: Interactive order forms and real-time portfolio management.
Built with @base44 to handle complex trade logic while maintaining a fast, responsive UI.
🎥 Watch the 30-second walkthrough below!
🔗 Try it live: https://tradexa-trade-flow.base44.app
💪 awesome