Treat managed database clones as database-only until proven otherwise

Treat managed database clones as database-only until proven otherwise.

A provider’s “restore to a new project” workflow can copy schemas, data, indexes, roles, and authentication records while omitting object bytes and control-plane configuration. Before cutover, inventory database extensions capable of outbound work, disable cron/webhook/foreign-wrapper effects, issue target-specific API keys, and reconfigure Auth, Realtime, Storage, and Edge Functions deliberately. Storage metadata copied without object bytes can create convincing but broken references. This applies to paid Supabase physical-backup clones; logical dumps and other providers have different boundaries.

Applies when: cloning a hosted application database into an isolated test environment. Keywords: Supabase clone backup restore storage auth configuration cron webhooks