Database backup strategy is defined

A database without automated backups means a single corruption event, accidental deletion, or infrastructure failure permanently destroys every user record with no recovery path. NIST SP 800-53 CP-9 (System Backup) and ISO 27001:2022 A.8.13 mandate backup procedures as baseline controls. Supabase's free plan provides no automated backups — a fact that many vibe-coded projects never discover until after data loss. The absence of backups is not a theoretical risk: accidental table drops, failed migrations, and ransomware attacks all produce irreversible data loss without a tested restore procedure.

Establish an automated backup schedule and verify it by performing a test restore before launch.

-- Supabase: automated daily backups on Pro plan
-- Verify at: Supabase Dashboard > Settings > Database > Backups

For Supabase free plan users, schedule supabase db dump -f backup-$(date +%Y%m%d).sql via a daily cron job or GitHub Actions workflow, storing dumps in a separate geographic region (S3, Backblaze B2). For Neon, PlanetScale, or AWS RDS, confirm your plan tier includes point-in-time recovery. A backup you have never restored is an untested backup — restore to a staging environment at least once before launch to confirm the procedure works.