Supabase Studio Provenance Audit 2026 06 23

Supabase Studio provenance and licensing audit

Date: 2026-06-23

Scope: apps/studio/**, packages/studio-*, packages/ui/**, root workspace manifests, lockfile metadata, and upstream Supabase repository/package metadata. This is an engineering provenance audit, not legal advice.

Answer#

Supabase is open source. The upstream supabase/supabase repository advertises itself as using open source tools and the GitHub license API reports Apache-2.0 for the repository root license.

Supabase Studio is source-available in that same repository under apps/studio. The upstream Studio app package is private and has no app-local license field, so Studio source inherits the repository-level Apache-2.0 license unless a nested package/file says otherwise. Several reusable upstream packages used by Studio, including packages/ui, packages/common, packages/config, packages/api-types, packages/ai-commands, packages/shared-data, and packages/pg-meta, declare MIT in package metadata.

This repo currently carries a restored/forked Studio surface rather than merely consuming published packages. apps/studio is a local Next.js app, and packages/studio-* are local workspace packages that mirror or rename Supabase monorepo packages for the Studio surface. The app still also imports the repo's unprefixed shared packages (ui, common, config, icons, shared-data) and published Supabase packages.

Evidence collected#

Upstream repository/license evidence#

Commands run:

1
$ git rev-parse HEAD
2
2c493783516e719d67197d7b2ff03292ccfaba49
3
4
$ git ls-remote https://github.com/supabase/supabase.git HEAD refs/heads/master
5
432b339ff9a7c7e30252272e36eea985ad589b5b HEAD
6
432b339ff9a7c7e30252272e36eea985ad589b5b refs/heads/master
7
8
$ curl -fsSL https://api.github.com/repos/supabase/supabase/license | jq '{name:.license.name,spdx:.license.spdx_id,path:.path,html_url:.html_url,download_url:.download_url}'
9
{
10
  "name": "Apache License 2.0",
11
  "spdx": "Apache-2.0",
12
  "path": "LICENSE",
13
  "html_url": "https://github.com/supabase/supabase/blob/master/LICENSE",
14
  "download_url": "https://raw.githubusercontent.com/supabase/supabase/master/LICENSE"
15
}

Upstream URLs verified:

• Repository: https://github.com/supabase/supabase
• Root license: https://github.com/supabase/supabase/blob/master/LICENSE
• Raw root license: https://raw.githubusercontent.com/supabase/supabase/master/LICENSE
• Root package metadata: https://raw.githubusercontent.com/supabase/supabase/master/package.json declares "license": "Apache-2.0".
• Upstream README: https://raw.githubusercontent.com/supabase/supabase/master/README.md says Supabase is built with "enterprise-grade open source tools" and "open source products".
• Studio app README: https://raw.githubusercontent.com/supabase/supabase/master/apps/studio/README.md describes "Supabase Studio" as a dashboard for self-hosted Supabase projects and hosted Supabase.
• Studio app package: https://raw.githubusercontent.com/supabase/supabase/master/apps/studio/package.json has "name": "studio", "version": "0.0.9", and "private": true; no app-local license field was present in fetched metadata.

Upstream reusable package metadata#

Verified with direct raw metadata reads from supabase/supabase@master:

Published Supabase package metadata used locally#

apps/studio/package.json and pnpm-lock.yaml show these published Supabase packages are used. The exact versions below are the local spec/resolved versions or catalog pins verified from manifests/lockfile, with npm metadata checked for the same versions:

The @supabase/shared-types npm metadata is the only published Supabase dependency in this checked set whose license field was not an OSI-style SPDX license. Treat it as a package-consumption dependency, avoid copying source from it without separate review, and keep it listed in any third-party notices process.

Current local Studio boundaries#

Workspace shape is defined by pnpm-workspace.yaml (apps/*, packages/*, tools/*). The file also includes a separate studio catalog that pins Studio-compatible versions for Next, React, Supabase JS packages, Tailwind, Vite, Vitest, TypeScript, etc.

apps/studio/package.json identifies the local Studio app as:

• name: studio
• version: 0.0.9
• private: true
• local build script: next build plus static asset upload unless SKIP_ASSET_UPLOAD=1
• local dev port: 3067
• no app-local license field

Local package metadata under the audited surface:

No LICENSE* or NOTICE* files were found within apps/studio, packages/studio-*, or packages/ui at max depth 3:

1
$ find apps/studio packages/studio-* packages/ui -maxdepth 3 \( -iname 'license*' -o -iname 'notice*' \) -print | sort | wc -l
2
0

Because the root Assistance package is Apache-2.0 and private, this is not immediately inconsistent, but any redistribution of Studio-derived code should preserve upstream Apache/MIT notices in a deliberate third-party notices file or package-level license documentation.

Current local usage/provenance map#

The local Studio app consumes both Studio-prefixed restored packages and unprefixed shared packages. Import-reference counts across apps/studio, packages/studio-*, and packages/ui were measured with rg and are directional evidence of active usage, not a dependency graph proof:

The active mix means the current code is not a clean package-reuse-only integration. It is a local fork/restoration of Studio code with partial deduplication against this repo's general shared packages.

Git history also supports that this was a restoration/rebrand path rather than an npm-only integration. Relevant recent local history for the audited paths includes commits named feat(studio): complete Supabase-to-Assistance rebrand sweep, feat(studio): rebrand core UI from Supabase to Assistance, and feat(dev): restore studio and saas api entrypoints.

License constraints and obligations to preserve#

• Apache-2.0 upstream root license allows use, modification, distribution, and sublicensing subject to preserving copyright/license notices, stating changes where applicable, and preserving NOTICE content if present upstream.
• MIT package-level licenses are permissive but require preserving the copyright and permission notice in substantial copies.
• Private internal use is lower risk than redistribution, but this repo should still keep provenance durable because the code has been copied/renamed/rebranded.
• Local packages without package-local license fields (apps/studio, packages/studio-icons, packages/studio-tsconfig) should not be interpreted as unlicensed upstream code; they sit under the repo root license locally, but their upstream analogues either inherit upstream root licensing or are private tooling packages.
• Avoid copying source from @supabase/shared-types based only on npm metadata because its license metadata is Copyright Supabase, not MIT/Apache. Package consumption through npm should be tracked separately from source vendoring.
• Supabase trademarks/branding are separate from copyright licenses. The code may be open source, but product names, logos, badges, and brand references should remain subject to trademark/brand review when rebranding to Assistance.

Recommendation#

Priority order for this repo:

1. Keep a deliberate Studio fork for apps/studio and the packages/studio-* surface. The current code is already a forked/restored app with substantial local import usage and Assistance rebranding. A fork is the clearest model for preserving local product changes while periodically rebasing/cherry-picking from upstream supabase/supabase.
2. Do not vendor additional upstream source casually. If new upstream Studio code is copied, record the upstream URL, commit SHA, source path, local path, license, and local modifications in the same audit family. Add a third-party notice/provenance file before any distribution channel depends on the fork.
3. Prefer published package reuse for stable client/runtime packages. Continue consuming @supabase/supabase-js, @supabase/auth-js, @supabase/realtime-js, @supabase/postgrest-js, @supabase/ssr, MCP packages, and @supabase/postgres-meta from npm when local source changes are not required.
4. Converge duplicate local package surfaces intentionally. studio-ui and ui, studio-common and common, studio-icons and icons, and @assistance/studio-pg-meta plus @supabase/postgres-meta are all currently active. Do not rewrite them in this audit slice, but choose one boundary per package family in a later implementation plan.
5. Treat packages/studio-pg-meta as a source fork until proven otherwise. It has a renamed package name, local MIT license metadata, and retained upstream repository metadata. If local changes are minimal, prefer using published @supabase/postgres-meta; if local changes are necessary, keep it as a fork with explicit upstream sync metadata.
6. Add durable third-party notices before external redistribution. The audited paths currently contain no nested LICENSE/NOTICE files. A future compliance slice should add a generated or curated notice document covering upstream Apache-2.0 and MIT sources plus the exceptional @supabase/shared-types package-consumption metadata.

Non-goals in this slice#

• No component rewrites were performed.
• No dependency versions were changed.
• No license legal conclusions beyond repository/package metadata were asserted.