Bil Harmer

CISO Supabase

[Bil Harmer @WilHarm3]

@HackingDave Had my whoop and cuff trigger afib so I went to Urgent Care. Being there got me wound up so much I had a panic attack. Turned out it was just PVCs. Using a Kardia now which can read the PVCs.
Glad you’re ok!

[Bil Harmer @WilHarm3]

The Wizard of Woz is coming to Select!!!!

[Supabase @supabase]

Supabase Select is a conference for builders, so we invited one of the first ones. 🪄

@stevewoz joins @kiwicopple on the Main Stage, October 2 in San Francisco.

See you there: https://t.co/iTHLK4Db9R

[Supabase @supabase]

Coming to Supabase Select 2026: @garrytan, President & CEO of @ycombinator, will join @kiwicopple for a fireside chat. 🎉

We'd love to see you there: https://t.co/IWKjWsZ95X

[Supabase @supabase]

Supabase Select is back!

October 2 in San Francisco.

Our user conference for builders, teams, and the open source community.

Registration is now open.
https://t.co/iTHLK4DIZp

[Bil Harmer @WilHarm3]

What an amazing milestone! And what an amazing offer to employees. I've never worked for a company that gives this much to it's employees before!

[Paul Copplestone - e/postgres @kiwicopple]

Supabase has raised $500M at a $10B valuation

In this round we are giving @supabase employees the opportunity to cash out 25% of their vested options. We have done this in every round since inception.

We do it as a “cashless transaction” so that employees don’t need to front any cash to exercise their options. This is the friendliest way we could design it until we can offer RSUs.

On top of that, we give employees a 10 year exercise window: whether they stay or leave the company. The typical/default window is 3 months. IMO, equity is earned and employees shouldn't be penalized because they don't have the cash to exercise within 3 months of leaving a job (often that's the time they need the cash/certainty the most).

[Paul Copplestone - e/postgres @kiwicopple]

supabase-py has crossed 1M downloads / day o PyPi

[Supabase @supabase]

As part of our effort to move the platform toward declarative code, new tables in the public schema will no longer be automatically exposed to the Data API in new Supabase projects starting May 30th.

Instead, tables will need to be explicitly granted each permission to each role, either through the dashboard or via SQL.

Explicit Postgres grants are reviewable, diffable, and greppable. They also give you per-role control: anon and authenticated need different privileges in most schemas, and an explicit grant makes that difference visible in your migrations. This was always possible; now it's the default.

[Supabase @supabase]

Hey SF - We're hosting a happy hour on April 28th. Come by!

https://t.co/jV25HcoMSb

[Supabase @supabase]

Supabase has hit an impressive 100,000 GitHub stars! 🌟

A massive THANK YOU to our amazing community for your unwavering support. Let’s keep building together!!

[Bil Harmer @WilHarm3]

This is such an important addition! Thanks to the @github team for this!

[Paul Copplestone - e/postgres @kiwicopple]

the new Supabase secret keys now have Push Protection on GitHub

credit to the @github team for this feature - it's table stakes for platforms as users adopt tools like OpenClaw and start yeeting code onto GitHub

[Supabase @supabase]

https://t.co/lMvgT1Gnwv

[Bil Harmer @WilHarm3]

@sama Promotvomit
or
Yeettext

[Bil Harmer @WilHarm3]

@jameszhou02 @kpolley James trying to get a hold of you. My team has checked the backend, it's not public.
I'd like you to send me the technical details of how you signed or got access to the URL you're using so I can investigate further.

[Supabase @supabase]

Use Supabase Realtime Broadcast to send and receive messages:

- Delivered in real time
- Scoped to specific channels
- Message persistence with onMessage and Message props
- Customizable appearance
- Auto scroll-to-bottom for new messages
- Room-based isolation

[Paul Copplestone - e/postgres @kiwicopple]

There are now 7M developers using @supabase

Signups have been accelerating since the start of the year

Our growth rate right now is as fast as it was during YC, except that we are doing it from a base of millions of developers instead of thousands

[Ant from Supabase @AntWilson]

✅ Claude Code
✅ Superpowers plugin
✅ Supabase
✅ Vercel

https://t.co/aXJmkWUbtY

[Supabase @supabase]

Log Drains are now on Pro

Send your Postgres, Auth, Storage, Edge Functions, and Realtime logs directly to Datadog, Sentry, Grafana Loki, Axiom, S3, or your own endpoint

Full-stack observability, no context switching

[Supabase @supabase]

We are pleased to inform our community that access to Supabase’s website https://t.co/IUZtExXZHw has now been fully restored for all users across India. We sincerely thank the Ministry of Electronics and Information Technology (MeitY) for their prompt action and constructive engagement in resolving this matter.

Access to our services has been fully restored, and we deeply appreciate the continued patience and support of builders, developers, and businesses across India. Thank you for your patience while we worked through this incident.

https://t.co/BQXFX2bWZd

[Bil Harmer @WilHarm3]

I spent years at SuccessFactors running SAS 70 audits with full transparency, giving customers the actual workbooks so they knew exactly what was being tested. That process helped shape what became SOC 2.

That was nearly two decades ago. The infrastructure has changed beyond recognition. The audit model hasn't.

So I built the replacement.

OTVP — the Open Trust Verification Protocol — replaces static audit reports with verification agents that scan live infrastructure and produce cryptographically signed trust assessments in seconds, not months.

This weekend I deployed 11 agents against a real AWS account covering 10 SOC 2 criteria. They found unencrypted databases, users without MFA, missing audit logs, and zero backup coverage — all named by resource ARN, all signed with Ed25519, all chained into Merkle trees for tamper-proof verification.

The full spec and SDK are open source. The dashboard shows real results from live infrastructure.

I wrote up the full story below:
https://t.co/PwSKidQR7Q

Live dashboard: https://t.co/F86s3ZMYmy
Spec: https://t.co/NkoqOPGPRj
SDK: https://t.co/CVZR9dKGGp

Looking for security practitioners who are tired of compliance theater, companies willing to run early agents, and GRC teams interested in integration.

The spec is open. The code runs. The conversation starts now.
#cybersecurity #soc2 #audit #opensource

[Paul Copplestone - e/postgres @kiwicopple]

we've added 7 new security events to @Supabase Auth to take action on suspicious behavior:

◆ Password changed
◆ Email address changed
◆ Phone number changed
◆ Identity linked
◆ Identity unlinked
◆ MFA method added
◆ MFA method removed

works with @resend: