Permissions, agents, and access control reshape the serverless Postgres landscape

Granular access arrives on Neon and Supabase

The most consequential change this week is Neon's launch of project-level permissions, letting you assign Viewer, Editor, or Admin roles on individual projects rather than across the entire organization. The new Collaborator organization role defaults to zero access until specific projects are granted, which teams with mixed-sensitivity databases will appreciate. Existing organizations are migrated automatically.

Supabase took a different approach to access control: Sign in with ChatGPT entered beta, letting you authenticate to supabase.com with your ChatGPT account and connect Supabase inside ChatGPT and Codex with one click. Existing accounts with matching emails are linked automatically. This removes friction for developers who build with AI assistants, but it also signals a broader shift toward identity federation as a product differentiator.

Durable diagnostics and agent benchmarking

PlanetScale gave operators two new CLI tools for understanding database behavior. The pscale insights command runs server-side analysis of production traffic to surface top queries, error patterns, resource anomalies, and schema recommendations, while pscale inspect provides live point-in-time checks over a read-only connection. Both support JSON output for scripting. Vitess users also gained query request size metrics — bytes received, bytes received per query, and max bytes received per query — pairing with existing bytes-returned columns to show two-way network traffic.

Supabase open-sourced supabase/evals, a benchmark and framework for testing how well coding agents like Claude Code and Codex build with Supabase. It runs agents against real tasks — debugging Edge Functions, fixing RLS policies, building schemas — and scores performance. This is as much a recruitment tool for better agent-powered workflows as it is a transparency play.

Security hardening across the stack

Supabase's CLI v2.111.0-beta.3 now revokes PUBLIC privileges by default in pg-delta, closing a common misconfiguration where new tables are accessible to every role. The JS client SDK moved OpenTelemetry tracing to an opt-in /tracing subpath in both canary and beta releases, reducing bundle size for non-tracing users. The client also stores PKCE verifiers in per-flow slots to prevent overlapping authentication flows from silently overwriting each other.

PlanetScale published SOC 1 Type 2 and SOC 2 Type 2 + HIPAA reports covering June 2025 to June 2026, available through their Trust Center. And the Neon changelog also brought roaringbitmap extension support for compressed bitmap operations — not a security change, but a nice addition for any analytic workload that needs efficient set operations.

CLI polish and ecosystem connections

The Supabase CLI saw a flurry of fixes across the week: bulk function deployments now continue past individual failures and always sync metadata, database connection failures surface root cause details instead of generic errors, and the --debug flag preserves TLS instead of disabling it. The Neon update also included schema-qualified table names in the MCP server and a Drizzle Studio 1.5.1 update with multi-column sorting and keyboard shortcuts, while the Supabase Auth admin list endpoint gained cursor-based pagination for managing large user bases.