Hidden Assumptions in supabase
12 assumptions this code never checks · 3 critical · spanning Resource, Environment, Shape, Temporal, Contract, Ordering, Domain, Scale
Every codebase relies on things it never checks. Most of them are routine. CodeSea looked at supabase/supabase and picked out the few most likely to cause trouble. The full list is just below.
Most of what this code assumes is routine. These 3 are the ones most likely to cause trouble here. The rest are minor; they're under "Show everything".
If the target file doesn't exist, has no default export, or exports a non-component, lazy loading fails at runtime with cryptic chunk loading errors that don't surface until users try to access that specific component
If IS_PLATFORM is undefined, null, or changes after startup, the tool aggregation logic silently switches between platform and self-hosted tool sets, potentially exposing unauthorized tools or breaking AI functionality
FileSystemFunctionsArtifactStore constructor succeeds but file operations fail later with permission or ENOENT errors when trying to read/write function artifacts, breaking function deployment silently
Show everything (9 more)
Values stored in localStorage are always valid JSON that can be parsed back to the original type T without data corruption
If this fails: If localStorage contains malformed JSON or data that doesn't match type T, JSON.parse throws uncaught errors and the hook returns initialValue instead, causing silent data loss of user progress and preferences
apps/learn/components/use-local-storage.tsx
Marketing campaign pages with removal dates in comments (like 'remove after May 31, 2026') will be manually cleaned up by developers checking the comments
If this fails: Expired campaign pages remain accessible indefinitely, serving stale content and potentially invalid offers or registration forms to users, wasting server resources and confusing customers
apps/www/_go/index.tsx
typeof window === 'undefined' reliably detects server-side rendering and window.localStorage is always available when window exists
If this fails: In environments like WebView, private browsing, or when localStorage quota is exceeded, window.localStorage might be undefined or throw SecurityError, causing the hook to crash with unhandled exceptions
apps/learn/components/use-local-storage.tsx
Custom font files (CustomFont-Book.woff2, CustomFont-Bold.woff2, etc.) exist in the same directory as this font configuration file
If this fails: If font files are missing, Next.js font loading fails silently and falls back to the fallback fonts without any error indication, potentially breaking the design system's visual consistency
apps/design-system/app/fonts/index.ts
The getMcpTools, getSchemaTools, and getIncidentTools functions return objects that conform to the ToolSet type structure without validation
If this fails: If any tool function returns malformed tools with missing required properties like name, description, or invalid parameter schemas, the AI system receives broken tool definitions and fails with runtime errors during tool execution
apps/studio/lib/ai/tools/index.ts
Object.keys(iconNodes) iteration order matches the expected icon export order and iconName keys are valid filesystem names that can be converted to PascalCase
If this fails: If iconNodes contains keys with invalid characters or the toPascalCase conversion produces duplicate component names, the generated export file has syntax errors or name collisions that break the build
packages/build-icons/src/building/generateExportsFile.mjs
The API and platform OpenAPI schemas have non-overlapping component names in their schemas, responses, parameters, requestBodies, headers, and pathItems sections
If this fails: If both API specs define components with identical names but different shapes, TypeScript interface merging creates union types that break type safety, causing client code to receive unexpected data structures
packages/api-types/index.ts
The number of lazy-loaded components in the registry won't exceed browser limits for concurrent dynamic imports or chunk loading
If this fails: With hundreds of components, simultaneous lazy loading could hit browser connection limits or cause memory pressure, leading to failed imports or degraded performance in the design system showcase
apps/design-system/__registry__/index.tsx
The dynamically imported './AppleSecretGenerator' component exists and exports a default React component that doesn't require SSR
If this fails: If the component doesn't exist, has no default export, or accidentally uses SSR-only APIs, the dynamic import fails and users see loading state indefinitely or get runtime errors
apps/docs/components/AppleSecretGenerator/index.tsx
See the full structural analysis of supabase: the pipeline, data models, and system behavior that put these assumptions in context.
Full analysis of supabase/supabase →Compare supabase
Frequently Asked Questions
What does supabase assume that could break in production?
The one most likely to cause trouble: React.lazy import paths like '@/../../packages/ui-patterns/src/Dialogs/ConfirmationModal' will always resolve to valid React components that export a default component If this fails, If the target file doesn't exist, has no default export, or exports a non-component, lazy loading fails at runtime with cryptic chunk loading errors that don't surface until users try to access that specific component
How many hidden assumptions does supabase have?
CodeSea found 12 assumptions supabase relies on but never validates, 3 of them critical, spanning Resource, Environment, Shape, Temporal, Contract, Ordering, Domain, Scale. Most are routine — the analysis flags the two or three most likely to actually bite.
What is a hidden assumption?
Something the code depends on but never checks: a data shape, an ordering, an environment condition, a scale limit, or a contract with another service. It holds until the world it runs in changes, then fails silently.