Pocketbase Best Practices

Comprehensive reference covering 63 rules across collection design, API security, auth flows, and deployment for PocketBase v0.36+. The categorization by impact (critical/high/medium) helps you prioritize what matters: locking down API rules, choosing auth vs base collections, and using filter binding to prevent injection. Strong coverage of server-side extending with both Go and JS hooks, including the gotchas around transaction scoping and JSVM module loading. The side-by-side examples for common patterns (OTP flows, realtime subscriptions, batch operations) make it genuinely useful when you're staring at the PocketBase docs at 2am trying to figure out why your relation queries are slow.

skills.sh installs: 908
GitHub stars: 14
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add greendesertsnow/pocketbase-skills --skill pocketbase-best-practices --agent claude-code

Installs into .claude/skills of the current project.

Files

PocketBase Best Practices

PocketBase is a single-binary backend (SQLite + REST + realtime + auth) that is easy to start with and easy to misuse at scale. This skill gives AI agents the guardrails: 64 rules across 9 categories, each with an incorrect vs. correct code example, covering the mistakes agents actually make — insecure API rules, unindexed queries, broken auth flows, N+1 expands, leaked server-side handles.

Updated for PocketBase v0.40 and JS SDK v0.28 (August 2026). Works with v0.36+.

How rules are prioritized

Every rule carries an impact level: Critical = security holes or broken data models, High = performance and correctness problems, Medium/Low = operational polish. When rules conflict, higher impact wins.