Best database for a vibe-coded app: Neon vs Cloudflare D1 vs Supabase

Who this is for: your app works, usually built with AI, but its data lives in a JSON file, local storage or memory. You want a hosted database on a free plan that won’t lose data, isn’t open to strangers, and that you can leave later.

Our pick: Neon (100/100). It’s plain Postgres, and it was the only one of the three that passed every check and every safe-default item without a settings change. Strangers can’t reach the data, unencrypted connections are refused, and the free plan includes up to 6 hours of instant restore if you break something. Setup took 21 lines with Neon’s serverless driver.

Runner-up: Cloudflare D1 (98/100). Also passed everything with no settings changes, and its free plan includes 7 days of point-in-time restore. The catch: D1 is meant to be used from a Cloudflare Worker, so it’s the natural choice only if your app’s backend already runs on Cloudflare. We found no security warnings page for it, which cost it the 2 points.

Also tested: Supabase (91/100). Choose it if you want login, file storage and a database in one place, or your AI tool already set it up. It passed every check, but its defaults are the loosest of the three (below).

It’s close. Neon and D1 were 2 points apart, so we ran both again on fresh databases, as our rubric requires. Both re-runs scored the same as the first. Neon wins on our tie-breaker, safe defaults.

Gotchas on default settings

Supabase: a table made with SQL is open to anyone. On a brand-new project, our notes table created with SQL was readable and writable by an anonymous request with just the public key. Supabase’s docs say the dashboard’s Table Editor turns row level security (RLS) on for you, but SQL doesn’t, and AI coding tools usually write SQL. Fix: run alter table <name> enable row level security; on every table, then add policies for what users may see. Supabase’s Security Advisor flags tables with RLS off. Supabase is replacing the anon key with a publishable key that is just as public, so RLS matters the same either way; see our publishable vs anon key checklist. For outside research on how common this is, see UpGuard’s study and our security check verdict.

Supabase: unencrypted connections are allowed, and no backups on Free. A direct database connection with encryption turned off was accepted. Fix: turn on “Enforce SSL” in Database Settings. Daily backups start on the Pro plan, so export your data yourself (pg_dump) on the free plan.

Neon’s no-signup databases expire. If an AI agent creates a Neon database for you without an account, it’s deleted after 72 hours unless you claim it into a free Neon account. Claim it, or create the database from your own account.

A JSON file loses data. Our starter app kept 1 note out of 50 saves fired at once, and reported success for all 50. Every database kept all 50.

Scores

Scored with our published rubric. Tested 2026-10-16. Neon and D1 are the average of two runs each (both runs scored the same); Supabase had one run.

Scroll sideways for more columns →

All three passed the checks that matter most: create, read, update and delete through the app’s API, notes kept after a restart, 50 simultaneous writes all saved, no secret in the browser, strangers unable to read the data (Supabase only after enabling RLS, as its docs say), and an export that restored elsewhere.

What it costs

All runs cost $0 on the free plans, with no card.

• Neon Free: $0, no credit card, 100 projects, 100 CU-hours a month per project, 1 GB storage per project, scales to zero after 5 minutes idle, instant restore up to 6 hours or 1 GB of changes (checked 2026-10-16).
• Cloudflare D1 on Workers Free: 5 million rows read and 100,000 rows written a day, 5 GB total storage, 500 MB per database, 7 days of Time Travel. Queries fail at the daily limit until 00:00 UTC (checked 2026-10-16).
• Supabase Free: $0 for a 500 MB database, 5 GB egress, 1 GB file storage and 50,000 monthly active users. Free projects pause after 1 week of inactivity, with a limit of 2 active projects. Daily backups come with Pro, from $25/month (checked 2026-10-16).

Caveats

• Different setups, same API. Each tool ran the same notes API the way its docs suggest: Neon from our Express server over its serverless driver, D1 inside a Cloudflare Worker, and Supabase inside a Supabase Edge Function (our test machine only allows HTTPS traffic, and Supabase’s server key never leaves its dashboard otherwise). Latency isn’t comparable across these setups, so we logged it but didn’t score it.
• Order matters. Supabase ran first, Neon second and D1 third, so the later runs reused the check script and lessons. Neon’s 37-second setup is flattering.
• D1’s first minute. In our D1 re-run, requests in the first seconds after creating the Worker got mixed errors. About a minute later everything passed. Give a new Worker a minute before testing it.
• Conflict to disclose: this site is hosted on Cloudflare Pages. It doesn’t change a score.
• Runs were done by an AI agent following vendor docs only. Neon used its official no-signup agent API; a person would normally sign up first.

Next step: add login. See our tested pick for adding login to your app. Storing files and images too? See file uploads for your app.

Before you launch: check your app’s security. See our vibe coding security check.

Not tested yet

• Firebase Cloud Firestore. It needs a console click to turn on for our project; queued for a person.
• Turso and Convex. Both need a browser signup; queued.

This page has no affiliate links yet. Every link goes to the tool’s own homepage. Affiliate deals never decide a pick, and a tool with no affiliate program can still win. How we make money.