Reqchain

I was about to buy a custom domain to put Cloudflare in front of my Supabase project. Then I read the documentation properly and found the line that killed the plan.

When you set up a custom domain, the original project URL stays live. The docs say you can use both interchangeably. And the project ref isn't a secret it ships in the browser bundle, because that's how the client connects in the first place.

So the proxy is optional for an attacker. Open devtools, read the original hostname, talk to the database directly. I'd have paid monthly for something that protects the URL in the address bar and nothing else.

The uncomfortable part is what that implies more broadly. The entire appeal of this architecture is the browser talking straight to the database. Which means every request that matters login, reads, writes, uploads never touches my application server. A WAF in front of my app protects my landing page.

Two months ago my production backend went offline. Not a bug, not traffic my credit balance hit zero, and the managed backend shut down with it. No users were affected, since I don't have paying customers yet, but the product was simply gone, for a reason that had nothing to do with my code.

That week I moved the database to my own Supabase. Harder than expected, for a boring reason: the dump was a custom-format file with zstd blocks and pg_restore refused it. I ended up reading the TOC with pgdumplib and pulling the data out by hand. 16 tables, 362 rows, 6 accounts with their original password hashes. I compared md5 on both sides before switching over. It worked, and the app has run on my own database ever since.

Last month I looked into moving the hosting too. That's where it got interesting.

I expected "connect GitHub, deploy elsewhere." But the build config isn't really mine. It imports a proprietary package that already bundles the framework, Tailwind, path aliases, env injection and the server adapter and the file itself warns that adding those plugins manually breaks the app through duplication. Leaving isn't a deploy step. It's rebuilding the build.

Every week, the same loop.

I'd ask someone to handle something: get three quotes, review the marketplace listings, pull numbers for the marketing meeting. A few days later I'd follow up. The answer, more often than not: "Sorry, I forgot."

The thing is, they weren't lying. The task was a message in a group chat, buried under fifty others by the next morning. I was asking people to remember things I'd given them nowhere to keep.