Early development · nothing works yet

Leave your Backend-as-a-Service without losing your users, data or access rules.

Unvendor is an open source CLI that moves a Supabase project onto infrastructure you control, one piece at a time.

• Supabase Postgres→→ PostgreSQL
• Supabase Auth→→ Auth.js or Keycloak
• Supabase Storage→→ Any S3 store (MinIO, Garage, ...)

Getting into Supabase is easy. Getting out is not.

Right now leaving means a dump, some one-off scripts and rewriting access control by hand. Unvendor turns that into something you can run and check.

What it does

1. 1

   Inventory

   Scans the project and lists what has to move.

2. 2

   Auth

   Moves users, identities and bcrypt hashes and keeps the user IDs, so nobody has to reset a password.

3. 3

   RLS

   Rewrites Supabase-specific policies into plain SQL using a small shim schema. Whatever it can't convert goes into the report.

4. 4

   Storage

   Copies buckets and objects and translates the access rules.

5. 5

   Verify

   Compares source and target: row counts, logins, and RLS checks that should be denied.

How it will work

$ npx unvendor inventory --source "$SUPABASE_DB_URL"
$ npx unvendor migrate auth --target keycloak
$ npx unvendor verify

• It never writes to your Supabase project.
• You can run it against a copy as many times as you want before the real cutover.
• Every change it makes ends up in the report.
• Sources are adapters, so Firebase or Appwrite can be added later.

Why not self-host Supabase?

That changes where Supabase runs, not what you depend on. You still run its services and stay on its schemas. Unvendor is for moving onto plain Postgres, your own identity provider and any S3 store, each replaceable on its own.

Roadmap

1. M1Inventory CLI
2. M2Auth migration (Auth.js, Keycloak)
3. M3RLS translation
4. M4Storage migration
5. M5Verification, docs, packaging