Skip to content
Roadmap

What we shipped, what's next.

No promises on dates - but we ship in tagged releases and write each one up in the changelog. If you want to push something up the list, email contact@suparbase.com.

Recently shipped

7 items
  • Two-factor authentication (TOTP + recovery codes)

    Optional 2FA via any standards-compliant authenticator (Authy, 1Password, Bitwarden). 10 single-use recovery codes generated at enable time. Required for admin-panel access in deployments that have admins configured.

    v3.8.0
  • Forgot-password flow

    Self-service password reset via email link. SHA-256-hashed tokens, 1-hour expiry, enumeration-resistant, single-use.

    v3.6.0
  • Account deletion (GDPR Art. 17)

    Self-service delete from /settings/account with typed confirmation. Cascades through every linked row.

    v3.6.0
  • Invoice history

    Dodo-hosted PDF invoices accessible from /settings/billing - no more digging through receipt emails.

    v3.7.0
  • Admin: audit log search

    Forensic search at /admin/audit by user, connection, table, verb, and date range. Backed by the new compound index.

    v3.6.0
  • Database optimisation pass

    Index rework, query refactors, partial indexes for unapplied webhook events, batched audit-log retention.

    v3.4.3
  • Agent Sentry (one-click session undo)

    Every AI-agent write is fingerprinted and bucketed into a session. One-click undo replays the audit log in reverse inside a single transaction.

    Feature page

In progress

3 items
  • Annual billing

    Discount for paying yearly. UI scaffolded; live once the Dodo product is published.

  • End-to-end Playwright suite

    9 smoke specs in place; signed-in flows + payment-flow specs are next.

  • Real-time error reporting (Sentry)

    Code paths instrumented via the reportError() shim. Operator-side wiring (instrumentation.ts + DSN) is in deployment guides.

Next

5 items
  • SSO via SAML / OIDC

    For Team-plan customers. Identity provider integration (Okta, Auth0, JumpCloud).

  • Connection import / export

    Bulk-paste multiple Supabase projects from a CSV / JSON; export them again with the encrypted blobs intact for migration.

  • SOC 2 Type I

    Pursuing certification through Drata. Readiness assessment complete; remediation in progress.

  • Public API

    Documented REST surface for the bits operators actually want to script (audit search, plan grants, connection CRUD).

  • More AI-write archetypes

    Sentry currently fingerprints 9 agent kinds (Cursor, Claude Code, Replit, Lovable, v0, Vercel AI SDK, OpenRouter, ai-unknown, browser, CLI). Add: Aider, Cline, Continue.dev, Devin.