Supabase Auth enforces unique email accounts in the same project; profiles.email is also unique.
Interactive Leaflet/OpenStreetMap pin, with optional browser geolocation.
General users see only their own reports.
Support/admin can see the operational queue and update statuses.
Only admins can promote registered users to support.
Footer icons for GitHub, Telegram, TikTok, Instagram, and X.
Create a Supabase project at .
Copy the Project URL and anon/public key into config.js .
In Supabase Authentication settings, turn OFF Confirm email if registration must work without sending a verification email/OTP. This means an email address is not verified, only unique in the project; use CAPTCHA/rate limits to reduce abuse.
Run supabase-schema.sql in the Supabase SQL Editor.
Register your own account through the app. In Authentication → Users, copy your account UUID. Run update public.profiles set role='admin' where id='YOUR-VERIFIED-USER-UUID'; in SQL Editor, replacing the placeholder.
Log out and log back in to load admin permissions.
Never put a service_role key or admin password in config.js or public GitHub.
Test before public launch
Use separate general, support, and admin accounts. Test direct API calls, not just the visible UI. The sample staff update policy currently allows staff to update report columns generally; add database-side field restrictions/audit logging before production. Do not use for real incidents until tested.
GitHub:
Telegram:
TikTok:
Instagram:
X:
If a social profile URL is different, edit the footer href in index.html .
Upload the files to the repository root. GitHub Pages can host the frontend, but Supabase must be configured separately. Browser geolocation requires HTTPS or localhost.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
