> Some have mentioned security concerns around how they handle auth

(Supabase maintainer) Just to sure: supabase is secure, audited, pentested, and well-maintained.

You can use it as a Postgres database, connecting to it in a "traditional" way. Or you can use it with some additional tools that we provide on top, so that you don't need to worry about middleware. Both are as secure as each other, but they require you, the developer, to take responsibility for your application security.

The latter relies on Postgres Row Level Security: it's built into Postgres and isn't novel to Supabase (but we are one of the few who really advocate for it because, well, we love Postgres and we're postgres-maxis)