docs(config): make .env.example match what the backend actually reads

[yougijain]

Config-only change, found while wiring up the Supabase scenario store. No code touched.

The problem

backend/.env.example listed three Supabase variables:

SUPABASE_URL=https://gsfrghcurkixqmrqghaw.supabase.co
SUPABASE_ANON_KEY=sb_publishable_xxxxxxxxxxxxxxxxxxxx
SUPABASE_SERVICE_ROLE_KEY=

Nothing reads any of them. The backend's entire env surface is five variables:

$ grep -rn "os.environ\|os.getenv" backend/app/
main.py:59       LINELAB_CORS_ORIGINS
main.py:65       LINELAB_CORS_ORIGIN_REGEX
scenarios.py:32  LINELAB_DATA_DIR
chat.py:37       ANTHROPIC_API_KEY
db.py:48         SUPABASE_DB_URL

db.py connects as postgres over the pooler and bypasses RLS on its own, which its docstring already says — no service-role key is involved. So the example was instructing you to fetch and paste a high-privilege secret into a variable with no effect. That is a bad habit to encode in the file people copy first.

The change

.env.example now documents exactly the five variables the code reads, grouped by purpose, each saying what happens when it is left unset — and noting that SUPABASE_DB_URL contains the database password and belongs in host environment variables, never in vercel.json.

The README gains a short section on the scenario store: the schema is created on first connect via ensure_ready rather than a migration step, and public.scenarios runs RLS enabled with no policies on purpose. The API is the table's only client; leaving RLS off would make the table readable and writable by anyone holding the project's publishable key, which is public by design.

Database state

The LineLab Supabase project was restored from its paused state and provisioned to match db.py's SCHEMA constant, so the app's own create table if not exists is a no-op:

• public.scenarios created, RLS enabled, no policies.
• The five built-in teaching spots seeded; select ... order by builtin desc, created_at asc returns them in the order list_scenarios() expects.
• Supabase security advisor returns no lints.

Setting SUPABASE_DB_URL in the Vercel dashboard is the only remaining step, and it is manual — it carries the database password, and the Vercel MCP server exposes no environment-variable tool.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
linelab	Ready	Preview	Sep 17, 2026 4:33pm UTC
linelab-api	Ready	Preview	Sep 17, 2026 4:33pm UTC