The "Supabase or roll our own?" question gets asked at every seed-stage company we talk to. The honest answer is: it depends on how much database operations work you want to be doing instead of building product.
For us the calculus was easy. RLS is a real authorization boundary, not a footnote. Auth is one decision instead of five. The escape hatch — direct SQL, your own migrations, your own connection pooler when you outgrow it — is fully open. We took the leverage.