[{"data":1,"prerenderedAt":935},["ShallowReactive",2],{"blog-en-aws-access-key-exposed-in-frontend":3,"blog-index-en":406},{"id":4,"title":5,"body":6,"category":363,"cover":364,"coverAlt":365,"description":366,"draft":367,"extension":368,"faq":369,"image":383,"keywords":384,"meta":393,"navigation":394,"ogTitle":395,"path":396,"published":397,"seo":398,"stem":399,"tldr":400,"updated":397,"__hash__":405},"blog_en\u002Fblog\u002Faws-access-key-exposed-in-frontend.md","An AWS access key exposed in your frontend is not like an OpenAI key",{"type":7,"value":8,"toc":350},"minimark",[9,18,21,26,39,45,59,65,69,72,79,85,91,97,100,104,107,110,116,119,128,132,135,138,141,150,155,159,162,171,198,209,217,221,224,227,238,241,245,251,260,280,290,307,310,314,337],[10,11,12,13,17],"p",{},"Someone opens your app in a browser, presses F12, and finds a string beginning\n",[14,15,16],"code",{},"AKIA"," sitting in your frontend code. Or GitHub emails you to say a commit you\npushed last March carries an AWS credential. The advice that arrives with\neither one is always the same: rotate the key. For most keys that is nearly the\nwhole answer.",[10,19,20],{},"Here is the part that guide after guide gets wrong. An AWS access key exposed\nin your frontend is not a key that spends money. It is a key that opens things,\nand the two go wrong in different directions. A key that only spends is a\ncompany card: somebody runs up a bill, you cancel the card, and the damage is a\nnumber you can read on a statement. A key that opens things is the set of keys\nto the depot. What it reaches depends on what was written on it when it was\ncut, which is something you can read off one screen in your AWS console.",[22,23,25],"h2",{"id":24},"what-does-akia-at-the-start-of-a-key-mean","What does AKIA at the start of a key mean?",[10,27,28,29,31,32,35,36,38],{},"It marks a long-term access key, belonging either to a user in your account or\nto the account's root login. AWS writes the prefix down in its own identifier\nreference: ",[14,30,16],{}," for access keys, and ",[14,33,34],{},"ASIA"," for the temporary ones that its\ntoken service hands out. So the first four characters tell you which kind you\nare looking at, and ",[14,37,16],{}," is the kind with no expiry on it. It works until\nsomebody switches it off.",[10,40,41,42,44],{},"An AWS credential is two strings, and a request needs both to be signed. The\nfirst is the access key ID, which is the part starting ",[14,43,16],{},". The second is\nthe secret access key, a longer string with no prefix on the front of it. The\nID alone signs nothing.",[10,46,47,48,50,51,54,55,58],{},"That is worth checking before you decide how bad a morning this is, because it\nchanges the answer. If your bundle carries the ",[14,49,16],{}," string and nothing\nresembling its secret half, a visitor reading your page got the name on the key\nand not the key. In practice the two usually travel together, because whatever\nput one in the browser put both: a pair of environment variables named\n",[14,52,53],{},"AWS_ACCESS_KEY_ID"," and ",[14,56,57],{},"AWS_SECRET_ACCESS_KEY",", read by code that was supposed\nto run on a server.",[60,61],"diagram",{"alt":62,"caption":63,"src":64},"Two values stacked on the left: a short teal one reading AKIA, and a longer one below it whose contents are drawn as blanked-out blocks. Both join into one arrow leading to a document with a key seal on it, which is ticked. Under a divider, the AKIA value on its own leads to a cross.","Both halves together sign a request. The identifier on its own is a name, and a name opens nothing.","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Ftwo-strings-one-signature-1600x640.png",[22,66,68],{"id":67},"what-can-someone-do-with-my-aws-access-key","What can someone do with my AWS access key?",[10,70,71],{},"Whatever its permissions allow, and nothing beyond them. So there are three\nanswers.",[10,73,74,78],{},[75,76,77],"strong",{},"What can it read?"," Every S3 bucket the policy lists, and every object in\nthem, including the ones you have never linked to from anywhere. A bucket that\nnothing in your app mentions is not hidden from a credential that can list it.",[10,80,81,84],{},[75,82,83],{},"What can it write?"," The same places, which is the half people forget. A key\nthat can write can also overwrite and delete, and a file replaced in place\nlooks exactly like the file you uploaded until somebody opens it.",[10,86,87,90],{},[75,88,89],{},"What can it start?"," This is the one with a meter on it. A policy wide enough\nto launch compute launches compute, and that bills by the hour for as long as it\nruns. Nothing about the browser's copy of the key limits how much of your\naccount it reaches; the policy is the only limit there is.",[10,92,93,94,96],{},"The worst version of this is a key cut for the account's root login. AWS's own\nguidance on the root user says it has unrestricted access to all AWS services,\nresources and billing information, and tells you not to create access keys for\nit at all. If the key in your page starts ",[14,95,16],{}," and belongs to the root user,\nthe thing exposed is the whole account and not one bucket.",[10,98,99],{},"So do not guess at any of this. Open IAM, find the user the key belongs to, and\nread the policies attached to it. That is one screen, and it answers all three\nquestions above.",[22,101,103],{"id":102},"do-i-just-rotate-it","Do I just rotate it?",[10,105,106],{},"Deactivate the exposed key today, and do not put a replacement in the same\nplace.",[10,108,109],{},"Deactivating is the right first move and it is gentler than it sounds. AWS lets\na user hold up to two active access keys at once, which exists precisely so a\nreplacement can be brought up before the old one goes down. Deactivating leaves\nthe key in place and switched off, and it can be switched back on; deleting is\nirreversible, and the secret half of a deleted key cannot be recovered. So\ndeactivate, watch what breaks, and delete afterwards.",[10,111,112,113,115],{},"What does not finish this is creating a new key and pasting it where the old one\nwas. The leak was never really about that particular value. It was about a\nbrowser holding a credential with no expiry, and everything your page\ndownloads, every visitor downloads. A fresh ",[14,114,16],{}," string in the same bundle\ncomes back as the same finding on the next scan.",[10,117,118],{},"AWS puts this plainly in its security audit guide, writing about mobile\napplications: they should never contain embedded access keys, even if\nencrypted. A browser bundle is read more easily than an app binary, so the same\nanswer holds here and costs a stranger less work to act on.",[10,120,121,122,127],{},"If you have already found the key in a public place, the order you work in\nmatters, and ",[123,124,126],"a",{"href":125},"\u002Fblog\u002Fapi-key-leaked-what-to-do","what to do when an API key leaks","\nhas that order laid out for keys of every kind.",[22,129,131],{"id":130},"what-a-presigned-url-does-instead","What a presigned URL does instead",[10,133,134],{},"It lets the browser do one thing to one file without holding a credential at\nall.",[10,136,137],{},"Your own server keeps the access key, where a visitor cannot read it. When your\npage needs to put a file into S3 or fetch one out, it asks your server, and\nyour server signs a URL for that one object and that one action and hands it\nback. The browser uses the URL and gets nothing else with it. AWS describes a\npresigned URL as granting temporary access to S3 objects without requiring AWS\ncredentials, and the same mechanism covers downloads and uploads.",[10,139,140],{},"Back to the depot. A presigned URL is meeting the courier at the door with the\none box they came for, instead of handing over the keys and trusting them to\nfind it. What the courier walks away with stops working when its clock runs\nout.",[10,142,143,144,146,147,149],{},"For the case where each signed-in person reaches their own files, AWS points\nsomewhere else again: its guidance on securing access keys says mobile\napplications should use Amazon Cognito to manage identities rather than\nembedding access keys. What Cognito hands the browser is a temporary\ncredential, the ",[14,145,34],{}," kind from the top of this article, which stops working\nby itself after a while. So a copy of it scraped out of your page on Tuesday is\nalready dead by Wednesday, and that is the one property an ",[14,148,16],{}," key does not\nhave.",[60,151],{"alt":152,"caption":153,"src":154},"Two routes drawn one above the other. Along the top, a browser with a key beside it, an arrow, and a rack of eight files on two shelves. Along the bottom, the same browser, an arrow to a server that holds the key, and an arrow on to a single file with a clock face next to it.","The top route puts something in the browser that works on every file, tomorrow as well as today. The bottom route gives it one file and a deadline.","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fkey-or-url-1600x700.png",[22,156,158],{"id":157},"how-do-i-check-whether-my-app-ships-an-aws-key","How do I check whether my app ships an AWS key?",[10,160,161],{},"Search what the browser downloaded, not what is in your project. Those are two\ndifferent files, and the one that matters is the one your visitors receive.",[10,163,164,167,168,170],{},[75,165,166],{},"In the browser."," Open your published site, press F12, and search the loaded\nJavaScript for ",[14,169,16],{},". Chrome and Edge search every loaded file at once from\nthe Sources panel.",[10,172,173,176,177,179,180,182,183,185,186,54,189,192,193,197],{},[75,174,175],{},"In your project."," Search for ",[14,178,16],{},", ",[14,181,53],{}," and\n",[14,184,57],{},". Then search for the two prefixes that put a value into\na bundle on purpose, ",[14,187,188],{},"VITE_",[14,190,191],{},"NEXT_PUBLIC_",", and read every value behind\nthem.\n",[123,194,196],{"href":195},"\u002Fblog\u002Fvite-and-next-public-env-vars","Why those two prefixes publish whatever they name","\nis the mechanic behind most of these, and it is a rule about the build that\nnobody typed by mistake.",[10,199,200,203,204,208],{},[75,201,202],{},"From outside."," Our free scan reads your published site the way a stranger\nwould and reports which credentials it can see in what you shipped, this one\nincluded. It takes about 20 seconds and needs no account:\n",[123,205,207],{"href":206},"\u002Fsecurity-scanner","scan your app free",".",[10,210,211,212,216],{},"Across every app we have scanned, this is a rare finding: an AWS access key\nturned up in 9 of the 31,056 apps where that check completed. The keys that\ncome up far more often are Google's, which are usually fine, and OpenAI's,\nwhich are usually not.\n",[123,213,215],{"href":214},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","What actually leaks out of apps built this way","\nsets all of them side by side with the counts.",[22,218,220],{"id":219},"what-the-key-did-while-it-was-out-there","What the key did while it was out there",[10,222,223],{},"Open CloudTrail event history and filter it on the access key ID.",[10,225,226],{},"Event history is on in every AWS account with nothing to switch on, it holds\nthe last 90 days, and it costs nothing extra. Every entry carries the access\nkey ID that made the call, so you can read back what your key did. That\nanswers the questions about configuration: a bucket created, a policy changed,\na user added.",[10,228,229,230,233,234,237],{},"Then there is the part worth knowing before you go looking. Event history holds\n",[75,231,232],{},"management"," events. Reading an object out of S3 is a ",[75,235,236],{},"data"," event, and AWS\nis explicit that trails do not log those by default and that data events do not\nappear in event history at all. Switching them on records from that moment\nforward.",[10,239,240],{},"So the honest reading is this. If the key was used to change your account, the\nlog will show you. If it was used to download the contents of a bucket, the log\nwill probably not, and you are deciding what to tell your customers on the\nbasis that it may have been.",[22,242,244],{"id":243},"keeping-a-key-out-of-the-next-build","Keeping a key out of the next build",[10,246,247,250],{},[75,248,249],{},"A credential leaves for the browser at build time, which means the next\ndeploy is the one to watch."," The key you take out today goes back in the\nafternoon somebody adds a feature that needs S3 and asks an agent to wire it\nup.",[10,252,253],{},[75,254,255,259],{},[123,256,258],{"href":257},"\u002Fwebsite-monitoring","Reeve Monitor"," reads your published site again for you:",[261,262,263,267,274,277],"ul",{},[264,265,266],"li",{},"all nine checks every hour, on up to three apps",[264,268,269,270,273],{},"a message when a result ",[75,271,272],{},"changes",", so a key that arrives on Tuesday does not wait until you next look",[264,275,276],{},"whether the app is up, every 60 seconds",[264,278,279],{},"a monthly report of what it saw",[10,281,282],{},[75,283,284,285,289],{},"If your app keeps its data in a Supabase project,\n",[123,286,288],{"href":287},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of that too:",[261,291,292,295,298,301,304],{},[264,293,294],{},"an encrypted copy of your Supabase database every night, kept where your project cannot reach it",[264,296,297],{},"each copy verified before it counts, by counting the rows in every table",[264,299,300],{},"a one-click restore when you need one",[264,302,303],{},"your uploaded files as well, once you connect a Storage credential",[264,305,306],{},"everything Monitor does",[10,308,309],{},"Every one of those nine checks describes what a stranger can reach. A copy of\nlast night's database is what answers the other question, which is what\nsomebody already altered while the key was out.",[22,311,313],{"id":312},"what-to-do-this-week","What to do this week",[315,316,317],"key-takeaways",{},[261,318,319,325,328,331,334],{},[264,320,321,322,324],{},"Open your published site, press F12, and search the loaded JavaScript for ",[14,323,16],{},". That is the file your visitors have, and it is the only one that counts.",[264,326,327],{},"If you find one, deactivate it in IAM today. Deactivating is reversible and takes effect at once; deleting is not, and the secret half cannot be recovered.",[264,329,330],{},"Read the policies attached to the key's user before you decide how serious this is. What it can read, what it can write and what it can start are three separate answers.",[264,332,333],{},"Replace the pattern rather than the value. Your server holds the key and signs a presigned URL for one object, or Amazon Cognito hands the browser a temporary credential that expires on its own.",[264,335,336],{},"Filter CloudTrail event history by the key for the last 90 days. It will show you what the key configured, and it will not show you which files it read unless data events were already switched on.",[10,338,339,340,344,345,349],{},"Start with the F12 search, because it settles in a minute whether you have a\nproblem at all. If it turns something up, the\n",[123,341,343],{"href":342},"\u002Fchecklist","10-minute security checklist"," covers the rest of what a newly\nlaunched app tends to leave open, and\n",[123,346,348],{"href":347},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","moving a secret to an edge function","\nis the pattern for every key that should never have been in the page.",{"title":351,"searchDepth":352,"depth":352,"links":353},"",3,[354,356,357,358,359,360,361,362],{"id":24,"depth":355,"text":25},2,{"id":67,"depth":355,"text":68},{"id":102,"depth":355,"text":103},{"id":130,"depth":355,"text":131},{"id":157,"depth":355,"text":158},{"id":219,"depth":355,"text":220},{"id":243,"depth":355,"text":244},{"id":312,"depth":355,"text":313},"Security basics","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcover-1200x630.png","A page of app code holding a short lit value and a long masked one, with a key lying across its corner and a rack of files behind.","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.",false,"md",[370,373,375,378,380],{"q":371,"a":372},"Is it ever safe to put AWS keys in frontend code?","No. AWS says so in its own security audit guide, about mobile apps: applications should never contain embedded access keys, even if encrypted. A browser bundle is easier to read than an app binary, so the same answer holds here and costs a stranger less work to act on. Where your page genuinely needs to reach S3, the supported routes are a presigned URL signed by your own server, or temporary credentials from Amazon Cognito, which expire by themselves.",{"q":68,"a":374},"Exactly what the permissions behind it allow, which is why there is no single answer. A key attached to a user with read access to one bucket reads that bucket. A key attached to an administrator does everything an administrator does, including starting machines that bill by the hour. A key belonging to the account root user is the worst case, because AWS states the root user has unrestricted access to all services, resources and billing information. Open IAM and read the policies attached to the key before deciding how worried to be.",{"q":376,"a":377},"What is a presigned URL?","A long URL that lets a browser do one thing to one file in S3, for a set number of seconds, without holding any AWS credential. Your own server holds the key and signs the URL on request. AWS describes presigned URLs as granting temporary access to S3 objects without requiring AWS credentials, and they work for downloads and uploads alike.",{"q":158,"a":379},"Search what your browser downloaded rather than what is in your project. Open your published site, press F12, and search the loaded JavaScript for AKIA. Then search your project for AKIA, AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, and for any variable name beginning VITE_ or NEXT_PUBLIC_ that holds one, because those prefixes are what put a value into the bundle in the first place.",{"q":381,"a":382},"My AWS key is on GitHub. What now?","Deactivate it in IAM first, which is reversible and takes effect immediately, then create a replacement for the server that needed it. Removing the key from your code does not close anything, because the old value stays in your commit history and in every clone anyone has made. After that, open CloudTrail event history and filter on the key to see what it did.","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",[385,386,387,388,389,390,391,392],"aws access key exposed in frontend","aws key in frontend","aws access key leaked","akia key exposed","aws secret access key in javascript","aws credentials in client side code","is it safe to use aws keys in react","aws key exposed github",{},true,"AWS access key exposed in your frontend?","\u002Fblog\u002Faws-access-key-exposed-in-frontend","2026-10-12",{"title":5,"description":366},"blog\u002Faws-access-key-exposed-in-frontend",[401,402,403,404],"An AWS access key exposed in your frontend is a different problem from a key that can only spend money. What it reaches is whatever its permissions allow.","Two strings sign an AWS request: an identifier starting `AKIA`, and a secret half. One without the other signs nothing.","A new key pasted into the same page is the same finding with a different value. The fix is a presigned URL, so the browser holds no credential at all.","We found one in 9 of the 31,056 scanned apps where that check completed.","3_OtOm3hPCsufDSRI9naDWnlLkzv9B3YoGFND4W7UFU",[407,413,419,425,431,437,443,449,455,461,467,474,480,486,492,498,504,510,516,522,528,534,540,546,552,558,564,570,576,577,583,589,594,600,606,612,617,623,629,635,641,647,653,659,665,671,676,682,688,694,700,706,712,718,723,729,735,741,747,753,759,765,771,777,783,789,795,801,807,813,818,824,830,836,842,848,854,860,866,872,878,884,890,896,901,907,913,919,924,930],{"path":408,"title":409,"description":410,"published":411,"category":363,"image":412,"draft":367},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":414,"title":415,"description":416,"published":417,"category":363,"image":418,"draft":367},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":420,"title":421,"description":422,"published":423,"category":363,"image":424,"draft":367},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":426,"title":427,"description":428,"published":429,"category":363,"image":430,"draft":367},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":432,"title":433,"description":434,"published":435,"category":363,"image":436,"draft":367},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":438,"title":439,"description":440,"published":441,"category":363,"image":442,"draft":367},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":444,"title":445,"description":446,"published":447,"category":363,"image":448,"draft":367},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":450,"title":451,"description":452,"published":453,"category":363,"image":454,"draft":367},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":456,"title":457,"description":458,"published":459,"category":363,"image":460,"draft":367},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":462,"title":463,"description":464,"published":465,"category":363,"image":466,"draft":367},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":468,"title":469,"description":470,"published":471,"category":472,"image":473,"draft":367},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":475,"title":476,"description":477,"published":478,"category":363,"image":479,"draft":367},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":481,"title":482,"description":483,"published":484,"category":363,"image":485,"draft":367},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":487,"title":488,"description":489,"published":490,"category":363,"image":491,"draft":367},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":493,"title":494,"description":495,"published":496,"category":363,"image":497,"draft":367},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":499,"title":500,"description":501,"published":502,"category":363,"image":503,"draft":367},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":505,"title":506,"description":507,"published":508,"category":363,"image":509,"draft":367},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":511,"title":512,"description":513,"published":514,"category":363,"image":515,"draft":367},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":517,"title":518,"description":519,"published":520,"category":363,"image":521,"draft":367},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":523,"title":524,"description":525,"published":526,"category":363,"image":527,"draft":367},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":529,"title":530,"description":531,"published":532,"category":363,"image":533,"draft":367},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":535,"title":536,"description":537,"published":538,"category":363,"image":539,"draft":367},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":541,"title":542,"description":543,"published":544,"category":363,"image":545,"draft":367},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":547,"title":548,"description":549,"published":550,"category":363,"image":551,"draft":367},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":553,"title":554,"description":555,"published":556,"category":363,"image":557,"draft":367},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":559,"title":560,"description":561,"published":562,"category":363,"image":563,"draft":367},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":565,"title":566,"description":567,"published":568,"category":363,"image":569,"draft":367},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":571,"title":572,"description":573,"published":574,"category":363,"image":575,"draft":367},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":396,"title":5,"description":366,"published":397,"category":363,"image":383,"draft":367},{"path":578,"title":579,"description":580,"published":581,"category":363,"image":582,"draft":367},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":584,"title":585,"description":586,"published":587,"category":363,"image":588,"draft":367},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":125,"title":590,"description":591,"published":592,"category":363,"image":593,"draft":367},"Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":595,"title":596,"description":597,"published":598,"category":363,"image":599,"draft":367},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":601,"title":602,"description":603,"published":604,"category":363,"image":605,"draft":367},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":607,"title":608,"description":609,"published":610,"category":363,"image":611,"draft":367},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":347,"title":613,"description":614,"published":615,"category":363,"image":616,"draft":367},"Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":618,"title":619,"description":620,"published":621,"category":363,"image":622,"draft":367},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":624,"title":625,"description":626,"published":627,"category":363,"image":628,"draft":367},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":630,"title":631,"description":632,"published":633,"category":363,"image":634,"draft":367},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":636,"title":637,"description":638,"published":639,"category":363,"image":640,"draft":367},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":642,"title":643,"description":644,"published":645,"category":363,"image":646,"draft":367},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":648,"title":649,"description":650,"published":651,"category":363,"image":652,"draft":367},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":654,"title":655,"description":656,"published":657,"category":472,"image":658,"draft":367},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":660,"title":661,"description":662,"published":663,"category":472,"image":664,"draft":367},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":666,"title":667,"description":668,"published":669,"category":472,"image":670,"draft":367},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":672,"title":673,"description":674,"published":669,"category":363,"image":675,"draft":367},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":677,"title":678,"description":679,"published":680,"category":363,"image":681,"draft":367},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":683,"title":684,"description":685,"published":686,"category":363,"image":687,"draft":367},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":689,"title":690,"description":691,"published":692,"category":472,"image":693,"draft":367},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":695,"title":696,"description":697,"published":698,"category":363,"image":699,"draft":367},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":701,"title":702,"description":703,"published":704,"category":363,"image":705,"draft":367},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":707,"title":708,"description":709,"published":710,"category":363,"image":711,"draft":367},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":713,"title":714,"description":715,"published":716,"category":363,"image":717,"draft":367},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":195,"title":719,"description":720,"published":721,"category":363,"image":722,"draft":367},"Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":724,"title":725,"description":726,"published":727,"category":363,"image":728,"draft":367},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":730,"title":731,"description":732,"published":733,"category":363,"image":734,"draft":367},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":736,"title":737,"description":738,"published":739,"category":363,"image":740,"draft":367},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":742,"title":743,"description":744,"published":745,"category":472,"image":746,"draft":367},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":748,"title":749,"description":750,"published":751,"category":472,"image":752,"draft":367},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":754,"title":755,"description":756,"published":757,"category":472,"image":758,"draft":367},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":760,"title":761,"description":762,"published":763,"category":363,"image":764,"draft":367},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":766,"title":767,"description":768,"published":769,"category":363,"image":770,"draft":367},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":772,"title":773,"description":774,"published":775,"category":363,"image":776,"draft":367},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":778,"title":779,"description":780,"published":781,"category":363,"image":782,"draft":367},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":784,"title":785,"description":786,"published":787,"category":363,"image":788,"draft":367},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":790,"title":791,"description":792,"published":793,"category":363,"image":794,"draft":367},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":796,"title":797,"description":798,"published":799,"category":363,"image":800,"draft":367},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":802,"title":803,"description":804,"published":805,"category":363,"image":806,"draft":367},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":808,"title":809,"description":810,"published":811,"category":363,"image":812,"draft":367},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":214,"title":814,"description":815,"published":816,"category":363,"image":817,"draft":367},"An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":819,"title":820,"description":821,"published":822,"category":472,"image":823,"draft":367},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":825,"title":826,"description":827,"published":828,"category":363,"image":829,"draft":367},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":831,"title":832,"description":833,"published":834,"category":472,"image":835,"draft":367},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":837,"title":838,"description":839,"published":840,"category":363,"image":841,"draft":367},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":843,"title":844,"description":845,"published":846,"category":363,"image":847,"draft":367},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":849,"title":850,"description":851,"published":852,"category":363,"image":853,"draft":367},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":855,"title":856,"description":857,"published":858,"category":363,"image":859,"draft":367},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":861,"title":862,"description":863,"published":864,"category":472,"image":865,"draft":367},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":867,"title":868,"description":869,"published":870,"category":472,"image":871,"draft":367},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":873,"title":874,"description":875,"published":876,"category":363,"image":877,"draft":367},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":879,"title":880,"description":881,"published":882,"category":363,"image":883,"draft":367},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":885,"title":886,"description":887,"published":888,"category":472,"image":889,"draft":367},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":891,"title":892,"description":893,"published":894,"category":363,"image":895,"draft":367},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":897,"title":898,"description":899,"published":894,"category":363,"image":900,"draft":367},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":902,"title":903,"description":904,"published":905,"category":363,"image":906,"draft":367},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":908,"title":909,"description":910,"published":911,"category":472,"image":912,"draft":367},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":914,"title":915,"description":916,"published":917,"category":363,"image":918,"draft":367},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":920,"title":921,"description":922,"published":917,"category":472,"image":923,"draft":367},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":925,"title":926,"description":927,"published":928,"category":472,"image":929,"draft":367},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":931,"title":932,"description":933,"published":928,"category":363,"image":934,"draft":367},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213636393]