Database Expert

database algorithm rules

When reviewing or writing code, apply these guidelines:

• You are an expert in database algorithms.
• Optimize algorithms for performance and scalability.
• Use appropriate data structures and indexing strategies.

database interaction best practices

When reviewing or writing code, apply these guidelines:

When interacting with databases:

• Use prepared statements to prevent SQL injection.
• Handle database errors gracefully.
• Consider using an ORM for complex queries and data modeling.
• Close database connections when they are no longer needed.
• Use connection pooling to improve performance.

database interaction rules

When reviewing or writing code, apply these guidelines:

• Async database libraries like asyncpg or aiomysql
• SQLAlchemy 2.0 (if using ORM features)
• Use dedicated async functions for database and external API operations.

database querying rules

When reviewing or writing code, apply these guidelines:

• Use Supabase SDK for data fetching and querying.
• For data model creation, use Supabase's schema builder.

prisma orm rules

When reviewing or writing code, apply these guidelines:

• Prisma is being used as an ORM.

supabase backend rule

When reviewing or writing code, apply these guidelines:

• Use Supabase for backend services (authentication, database interactions).
• Handle authentication flows (login, signup, logout) using Supabase.
• Manage user sessions and data securely with Supabase SDK.

supabase integration in next js

When reviewing or writing code, apply these guidelines:

You are familiar with latest features of supabase and how to integrate with Next.js application.

supabase integration rules

When reviewing or writing code, apply these guidelines:

• Follow best practices for Supabase integration, including data fetching and authentication.
• Use TypeScript for type safety when interacting with Supabase.

supabase specific rules

When reviewing or writing code,

Consolidated Skills

This expert skill consolidates 1 individual skills:

• database-expert

Iron Laws

1. ALWAYS use parameterized queries or ORM query builders — never concatenate user input into SQL strings under any circumstances.
2. NEVER expose database connection strings or credentials to frontend code — all DB access must go through server-side API functions or edge functions.
3. ALWAYS enable Row-Level Security (RLS) on Supabase/PostgreSQL tables that contain multi-tenant or user-scoped data.
4. NEVER run queries without pagination on tables that can grow unbounded — always add LIMIT or cursor-based pagination to prevent timeout and memory spikes.
5. ALWAYS use database transactions for multi-step operations that must be atomic — never rely on independent sequential queries when data consistency is required.

Anti-Patterns

Anti-Pattern	Why It Fails	Correct Approach
String-concatenated SQL queries	SQL injection vector; one unsanitized input compromises the database	Use ORM query builders or parameterized prepared statements
No RLS on multi-tenant tables	Any authenticated user can read/write other users' data	Enable RLS policies scoped to auth.uid() on all user-scoped tables
Unbounded .findAll() / SELECT * without LIMIT	Returns entire table; causes timeouts and memory spikes on large datasets	Always paginate with LIMIT/OFFSET or cursor-based pagination
No connection pooling	Serverless functions exhaust database connections under load	Use PgBouncer / Supavisor in transaction mode
Logging full query strings with values	Leaks PII and credentials into log aggregators	Log query templates only; redact all bound parameter values

Memory Protocol (MANDATORY)

Before starting:

cat .claude/context/memory/learnings.md

After completing: Record any new patterns or exceptions discovered.

ASSUME INTERRUPTION: Your context may reset. If it's not in memory, it didn't happen.