Every word the lessons introduce, in plain language. 73 of them. Nothing here assumes you have read anything else on this page.
Your identity on a website — an email address, a password, and a name that belongs to you.
The three quests each start by making one, because nothing else can be yours until there is a you.
The Git command that marks a changed file as one you want included in your next recorded change.
`git add` does not save anything on its own. It is you pointing at files and saying “these ones”; `commit` is what records them.
The old name for Supabase's publishable key — the one that is safe to put in your app.
“Anon” is short for anonymous: it is the key used before anyone has signed in. Newer projects call the same thing the publishable key.
See alsopublishableAPI keysecret
A long string of characters that tells a service which project a request belongs to.
Supabase gives you two. One is meant to be public; the other must never leave the dashboard. Knowing which is which is the whole of that lesson.
See alsopublishablesecretservice role
Inside a database rule, this stands for “whoever is asking right now”.
It is how a rule says “only show a person their own rows”: `auth.uid() = user_id`. If nobody is signed in, it is empty, and rules that use it let nothing through.
See alsopolicyRLSauthenticated
In a database rule, this means “anyone who has signed in”.
It is broader than people expect. It is not “my staff” — it is every single person with an account on that project. Rules meant for a few people should name those people, not use this.
See alsopolicyRLSauth.uid()
An app on your phone that shows a six-digit code, changing every thirty seconds.
The code proves you are holding your phone, so a stolen password alone is not enough to get in. Google Authenticator, 1Password and Authy all do the job.
See alsotwo-factorrecovery codes
Your own line of changes, running alongside the main one, that nothing else sees until you say so.
This is the safety net for vibe coding: let an AI rewrite twelve files on a branch, look at the result, and throw it away if it is wrong. `main` is untouched the whole time.
See alsomainpull requestmerge
Turning the files you wrote into the files a browser can actually run.
It happens on Vercel's computers, not yours, which is why a project can build on your laptop and fail there.
See alsobuild logdeploymentbuild command
The one line Vercel runs to build your project.
Vercel almost always guesses it correctly from the kind of project you imported. If you find yourself editing it by hand on your first deploy, something else is wrong.
See alsobuildframework preset
The running commentary of a build, including the reason it failed.
Read the FIRST red line, not the last. Everything after it is usually knock-on damage from that one problem.
Copying a repository from GitHub down onto your own computer, history and all.
After cloning you have a real folder you can open in an editor. Changes you make there are yours alone until you push them.
See alsorepositorypushorigin
One kind of fact in a table — name, email, price — the same kind all the way down.
See alsotablerowprimary key
A line you type into the terminal and press Enter on.
Commands are picky about spelling and spaces but harmless to read. Anything starting `git status`, `select`, or `--version` is only ever looking, never changing.
See alsoterminal
One recorded change to your files, with a short message from you saying what it was.
A commit is the unit you can go back to. “It worked an hour ago” is only useful if there was a commit an hour ago.
Where an app keeps anything it has to remember after the page closes.
Without one, every reload forgets everything. Supabase gives you a real one without you having to run it yourself.
The password your app uses to reach the database — not the one you log in to Supabase with.
Supabase shows it once, when the project is created. Save it in a password manager at that moment; resetting it later means updating every place you used it.
What a column gets filled in with when you do not supply anything.
This is why you can save a row without typing an id or a time: the database fills those in for you.
See alsocolumntimestampprimary key
Putting your project on the internet so other people can open it.
See alsodeploymentproductionhosting
One particular attempt at putting your project online, kept forever with its own address.
Because every one is kept, going back to a version that worked is a click, not a repair job.
See alsodeployrollbackpreview deployment
A file holding the settings and keys your project needs, kept on your machine and never pushed.
The dot at the start matters, and so does the `.env*.local` line in `.gitignore` that stops it ever reaching GitHub.
The program you actually write code in — VS Code, Cursor, Zed.
It is where an AI assistant can see your real files, which is the difference between it guessing and it helping.
See alsoextension
A named setting passed to your project from outside its code, like `SUPABASE_URL`.
They exist so a key can change without the code changing. On Vercel they are read while building, which is why adding one does nothing until you redeploy.
See also.env.localredeploy
The number a command leaves behind to say whether it worked. Zero means fine; anything else means trouble.
An add-on that teaches your editor something new.
The one worth having early is the GitHub one, so committing takes a click instead of a typed command.
See alsoeditor
A build or deploy that stopped before finishing. Your live site is untouched.
A failed deploy is not a broken site. Vercel keeps serving the last one that worked.
See alsobuild logdeploymentrollback
Vercel's guess at what kind of project you imported, and therefore how to build it.
If it recognised your project, leave every build setting alone.
See alsobuild commandimport
A list of files Git should pretend not to see, so they can never be committed or pushed.
Check it with `git check-ignore -v .env.local`. An answer means the file is safely ignored; silence means it is not.
See also.env.localcommit
Every commit in a repository, in order — the whole record of how the files got this way.
The history is what makes a repository different from a folder, and it is why deleting a leaked key from a file does not remove it.
See alsocommitrepository
Someone else's computer running your site so it is there when people visit.
See alsodeployproduction
On Vercel: picking a GitHub repository to build and put online.
Also a word in code — `import` at the top of a file pulls in something from elsewhere. Same word, unrelated jobs.
Adding a new row to a table.
See alsorowtable editorselect
Putting a program onto your computer so you can use it.
A terminal only notices programs that existed when it opened, so after installing something, open a new terminal window.
The default line of changes in a repository — the version everyone treats as the real one.
Vercel deploys `main` to your live address, so what is on `main` is what the world sees.
See alsobranchmergeproduction
Folding the changes from a branch into `main`, so they become part of the real thing.
Once you have Vercel connected, merging is shipping. Nothing else to do.
See alsobranchpull requestmain
Git's nickname for the copy of your repository that lives on GitHub.
`git push -u origin my-branch` means “send this branch to the GitHub copy”. There is nothing special about the word; it is just the default name.
See alsopushclonerepository
A rule saying who may read or change which rows in a table.
Policies are the whole of database security. With RLS on and no policies, nothing is readable — which is the safe place to start from.
See alsoRLSauthenticatedauth.uid()
A version of your site built from a branch, at its own address, with your live site untouched.
See alsopreview deploymentbranch
The deploy Vercel makes automatically for every branch you push.
It posts the address as a comment on your pull request, so you can look at what an AI wrote on the real internet before anyone else can.
A value unique to one row, so you can point at exactly that row and no other.
Usually an `id` the database fills in. It is the one thing a spreadsheet does not have.
A repository only you and the people you invite can see.
See alsopublicrepository
The real thing, live, at the address you give people. As opposed to a preview.
See alsoproduction deploymentpreviewmain
The deploy that updates your live address, made when something lands on `main`.
See alsoproductionmergerollback
On Supabase: one database, with its own address and its own keys.
Each project has its own set of accounts too, which is why a learning site and a business system should not share one.
A repository anyone on the internet can read.
Public is fine for code. It is not fine for keys — bots scan new public commits for them within minutes.
See alsoprivate.gitignoresecret
The Supabase key that is designed to sit in your app where anyone can read it.
It is only safe because your policies decide what it can actually see. With no policies and RLS off, “publishable” means “public”.
A request to fold a branch into `main`, with a page showing exactly what would change.
Open the Files changed tab: added lines are green, removed lines are red. That view is the point of the whole thing.
Sending your commits up to GitHub.
Until you push, your work exists only on your laptop — and Vercel can only deploy what is on GitHub.
The page shown when someone opens your repository. Plain text, written by you.
See alsorepository
One-time codes that get you into your account if you lose your phone.
They are the only way back in. Nobody at GitHub can restore an account without them, so save them somewhere that is not the computer you are sitting at.
See alsotwo-factorauthenticator app
Building and publishing again, without changing any code.
Needed after adding an environment variable, because variables are read while building. Skip it and it looks like the variable did not work.
See alsoenvironment variabledeployment
Which part of the world your database physically sits in.
Pick the one nearest the people who will use your app. It cannot be changed later.
See alsoproject
Short for repository. Everyone says repo.
See alsorepository
A folder whose every change is recorded — not just how the files are now, but every version they have been.
Think of a document where every save is kept forever and labelled with what changed. A repository does that for a whole folder.
Which of your repositories you let another service read.
Choose “only select repositories” rather than all of them. You can add more in one click later; you cannot un-grant a habit.
Reading exactly what a change does before letting it into `main`.
The pull request's Files changed tab is the review. With an AI writing the code, this is the step where you are still the one deciding.
See alsopull requestmerge
Row Level Security: the database checking every read and write against your rules, row by row.
With RLS on and no policies written, nothing is readable. That sounds broken and is actually correct — it means a mistake locks people out rather than letting them in.
See alsopolicyauthenticatedpublishable
Putting a previous deployment back as the live one.
On Vercel: open the old deployment, choose Promote to Production. Seconds. Knowing this exists is what makes shipping calm.
See alsodeploymentproduction deployment
One actual thing in a table — one customer, one order, one note.
See alsotablecolumnprimary key
The Supabase key that ignores every security rule. It belongs on a server, never in code you push.
If it ever reaches a repository, rolling it is the fix — not deleting the commit, because the history keeps it.
The SQL word for read. `select * from notes` means “show me everything in notes”.
See alsoSQL editorinserttable
The old name for Supabase's secret key — the one that bypasses all your rules.
Proving to a site that you are you, so it shows you your own things.
See alsoaccountsign in with GitHub
Using your GitHub account to prove who you are to another site, instead of making a new password.
It is not handing over your code. Access to your repositories is a separate permission you grant on purpose.
See alsosign inrepository access
A box in the Supabase dashboard where you type database commands and see the answer.
It views your data as the owner, which ignores RLS — so everything always looks readable there. Test your policies from your app instead.
See alsoselectRLStable editor
A sheet of data: columns for the kinds of fact, rows for the actual things.
See alsorowcolumnprimary keytable editor
The spreadsheet-like screen in Supabase for making tables and typing rows by hand.
See alsotableinsertSQL editor
A window where you type commands instead of clicking.
Mac: press Command and Space, type Terminal. Windows: press Start, type PowerShell. Nothing in it happens until you press Enter.
A column type for ordinary writing of any length.
A column type holding a date and time, usually the moment a row was made.
See alsocolumndefault value
Needing a code from your phone as well as your password to get in.
It is the single most useful thing you can switch on. A stolen password stops being enough.
See alsoauthenticator apprecovery codes
Your short public name on a site, and part of every address you share.
`github.com/yourname` is built from it, so changing it later breaks those links. Choose one you would put on a CV.
See alsoaccount
Still stuck on a word? Back to the quests — every lesson lists the words it introduces, and they all link here.