HN Explorer

Ask HN: What in the world is going on at Supabase?

57 points by DANmode ↗ HN
Raising more money, but can't reply to vital support/security inquiries?

Like the final request of mine below, asking them to save their own resources, because someone was spinning up fake trials or something using my company's domain:

"Please cancel these signups, they're fraud." Hide quoted text

---------- Forwarded message --------- From: Supabase Auth <noreply@mail.app.supabase.io> Date: Sat, Jul 12, 2025, 5:15 PM Subject: Confirm Your Signup To: <employee@***.com>

Confirm your signup Follow this link to confirm your user:

Confirm your mail

You're receiving this email because you signed up for an application powered by Supabase Opt out of these emails Hi there,

Thanks for reaching out to us. We have received your support request and your ticket id is SU-223879

Free plan will receive no guaranteed support response - we try to respond to outage related issues asap however Pro and Enterprise tickets take priority. Upgrade here.

For non-outage related issues, Free plan users are encouraged to ask their questions inside our GitHub Discussions https://github.com/supabase/supabase/discussions.

The Supabase Team.

Me: This is a pretty bad smell for this to still be unanswered and ongoing.

Your "Opt-Out" link remains broken - how is anyone supposed to get in touch with you?!

2-3 months go by: Hey,

For security reasons, we’re not able to process requests submitted by email. Please resubmit your request through the Support Portal so we can verify project ownership.

If your request falls into one of these categories, here’s how to proceed: If your issue is related to login access and this ticket was closed in error, just reply to this email and we’ll reopen it For account deletion, you can remove your account directly in your Supabase dashboard For the latest DPA, visit the Legal Documents page To report a security issue, please submit it through our HackerOne program

Thanks for your understanding, Supabase Support Team Website • Docs • Community • Twitter • Status Sent from Front

"Wow...I'm not a customer.

Months later, this is still unresolved?"

14 comments

[ 3.2 ms ] story [ 40.5 ms ] thread
[deleted]
(comment deleted)
DANmode
I want to underline the fact that I am not a client, nor has my firm ever registered with them, so this is a security/fraud correspondence...not customer service.

Emails to support@, info@ etc multiple TLDs, all ignored for months...

kiwicopple
hey DANmode - supabase ceo here. similar to the sibling thread I want to make sure I know what happened here:

  1. someone created an website using supabase with email logins (and possibly edited the template / opt-out link)
  2. someone signed you up to that service - you received an email from that app 
  3. you sent us an email (to support@supabase.io or similar) to report abuse
  4. we emailed a few months later with the generic email you posted
First, I'm sorry you had a bad experience. we have been historically very on-top of our support emails, but this year the tickets have grown ~10x while our team can only grow ~2x. We have had to make short-term trade-offs (automations) which are sub-par so that we can catch up with the growth and primarily focus on the paying customers

I'm be the first to acknowledge that this is something we want to improve. Unfortunately that will take time and iterations - you are experiencing our support (i hope) at it's worst. We sent an email to the backlog of unanswered free-plan emails just to acknowledge and redirect them somewhere we can offer more support

For security/fraud, we have a slightly different process: https://supabase.com/.well-known/security.txt

This process is to ensure that we _don't_ miss emails, like we did with yours.

You post here is helpful for us to figure out the areas that we need to improve. Again, I'm sorry that we didn't give you a good impression the first time - all we can do is iterate based on feedback like yours. If you want to share more my email is in my profile

DANmode
I believe the biggest issue is that the ONLY lever the email gave the user to pull (the Opt-Out of these emails link) was broken. (FYI: It's working now.)

I still don't even know if that does what I think it does (it sounds like marketing list opt-out).

/ /

How is a user, who has been signed up for your services without their knowledge, meant to "opt out" of the trial, or account, after the point of receiving the email,

if they never even initiated the account on your end?

dontdoxxme
The sad fact is investors don’t care about abuse. Provided the company aren’t deliberately faking customers there is no incentive to spend any resources on a free trial other than looking for customers to convert.
cadamsdotcom
Sympathy to you for these woes.

While this sucks, your best bet is to vote with your wallet, find a way to act as though they don't exist, and leave them to their own devices.

AznHisoka
They also never mailed me free t-shirt for completing their State of Startups survey a few months back
kiwicopple
let me follow up with the team to find out what happened here
csomar
They are squeezing the free tier hard to monetize. It never made sense in the first place (they don't have their own servers, they host on AWS). It probably cost them something like $10-15/free customer. That's as bad or worst than many of the AI startup burning money to acquire customers. Also the free tier is good for most people, so why pay up?

I got my DB paused a few times despite it being active (the irony is that I have an inactive DB that was not affected).

gelfunde
I would differentiate between a bad customer service, that answers too late and doesn’t think outside the box versus their product. As a customer I am actually pretty happy with what I’m getting, but apparently this will only remain true as long as I don’t need to contact anyone. I guess they think they don’t need good customer support if the product is good enough for no one to complain.
lucasknight
supabase supabase supabase

@kiwicopple - given you have keyword notifications set up on here [0], between this and your current AWS situation, this is not a good look

[0] https://news.ycombinator.com/item?id=42223240

kiwicopple
thanks for the tag lucasknight - i'll respond inline to OP about their email situation

> your current AWS situation

I think the assessment here is accurate:

https://x.com/theo/status/1979271205279666586

> Looked into this a bit. I don’t think “downtime” is a fair way to report on this. No existing databases are affected. Amazon is literally out of boxes in eu-west-2, so Supabase can’t provision NEW DBs in that one specific region

I want to own the fact that we can be multi-cloud, and that we can work with AWS on their capacity planning (note: this is not a typical request for an increase on a soft limit). We are working through both of these options. That said, the Reddit poster classifying this as days of downtime is not entirely fair, and it makes it harder to for us to over communicate with our community. Throughout this period we had days where there was free of capacity on AWS and we chose to leave the status up until we have finalized our conversations with AWS.

I also want to acknowledge that there is a broader AWS issue today in us-east-1 which affects us (and most other companies today) that is unrelated

https://news.ycombinator.com/item?id=45640838

patricktttt4
Nobody is going to see this. They are a Y Combinator and claim to have Hacker News locked down.
ibejoeb
Here's how I'm interpreting this:

    1. your company owns example.com
    2. someone signs up to supabase with alice@example.com
    3. you receive the confirmation email somehow (which probably isn't important)
       a. either the email address is valid, 
       b. it is delivered some catch-all mailbox
    4. you email supabase support notifying them that someone is signing up with an address that your company controls
Is that right? If so, I don't think this is some kind of vital security event. The confirmation email won't be delivered to the purported bad actor, so the account won't verify.