$ the-wire · showcase
Supabase ships recovery-code MFA sign-in, new stack init flag
By RepoJournal · Filed · About Supabase · Composed from the cited sources · methodology
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?v=4)
Account recovery gets a real fallback for locked-out MFA users, the CLI pushes its experimental stack behind a flag, and the docs evals flag three guides where agents can reach for the wrong auth path.
Recovery codes: allow users to use recovery codes to access their account (#50569) supabase/supabase
Users redirected to the MFA verification page can now complete sign-in with a recovery code instead of being stuck without their second factor. It closes the last dead end in the account-recovery flow, so a lost authenticator no longer means a lost account.
feat(cli): opt supabase init into the experimental stack via env supabase/cli
`SUPABASE_EXPERIMENTAL_STACK=1 supabase init` now writes `[experimental] stack = true` and drops the Docker-era default ports so the new stack is not pinned to legacy local listeners. Unset or `0` keeps the existing Go-parity template, invalid values fail closed, and blank `supabase bootstrap` uses the same scaffold, so only projects that opt in see the change.
fix(cli): fail `storage rm` without confirmation (CLI-2464) supabase/cli
In `json` and `stream-json` output, which a detected coding agent gets by default, the confirmation helper could not prompt and defaulted to no, so `storage rm` deleted nothing, printed an empty `deleted` list, and still exited 0. It now fails with `StorageRmConfirmationRequired` instead of reporting a successful deletion of zero buckets.
fix(stack): log target failures and handle disconnections quietly (#6691) supabase/cli
A failed lazy wake used to surface only as a `502` or a dead socket, with the cause discarded and `error=undefined` in `stack status`. The proxy now logs the route and cause and reports the failure to service observation, while ordinary client disconnects are typed as their own error rather than proxy failures.
feat(evals): eval the Storage access control guide in supabase.com/docs (#292) supabase/evals
The Storage Access Control page teaches policies on `storage.objects` but never says a public bucket serves every object it holds regardless of those policies, and one support case was a broad read policy on a public bucket that exposed every stored file. The eval pins the correct answer in place for agents asked to store user photos.
feat(evals): eval the Securing Edge Functions guide in supabase.com/docs (#296) supabase/evals
The Securing Edge Functions guide presents four auth modes and puts two clients on the same context object, one of which bypasses row level security, with the mode that skips every credential check sitting three sections down under a harmless-sounding heading. The eval encodes which mode an agent should reach for.
Fix tooltip a11y comment (#50640) supabase/supabase
A comment explaining why `aria-describedby` is stripped from tooltips so screen readers do not read the same text twice was wrong. The replacement explains the actual reason, mostly a note for whoever edits the component next.
Action items
