[{"data":1,"prerenderedAt":593},["ShallowReactive",2],{"blog-en-back-up-supabase-free-tier":3,"blog-index-en":351},{"id":4,"title":5,"body":6,"category":309,"cover":310,"coverAlt":311,"description":312,"draft":313,"extension":314,"faq":315,"image":331,"keywords":332,"meta":339,"navigation":340,"ogTitle":341,"path":342,"published":343,"seo":344,"stem":345,"tldr":346,"updated":343,"__hash__":350},"blog_en\u002Fblog\u002Fback-up-supabase-free-tier.md","Supabase free tier backups: how to make one without a terminal",{"type":7,"value":8,"toc":297},"minimark",[9,13,21,24,29,32,41,45,48,51,54,58,61,125,131,139,142,149,153,159,175,192,197,205,209,217,220,223,227,230,235,253,265,269,289],[10,11,12],"p",{},"Your project is on the Supabase free tier, and you have opened Database, then\nBackups, looking for a list of dated copies to restore from. There is nothing\nthere. No dates, no restore button, only a note about upgrading. The page is not\nbroken. There are no Supabase free tier backups to list, because the plan takes\nnone.",[10,14,15,16,20],{},"Here is where most answers to this go wrong. They hand you a ",[17,18,19],"code",{},"pg_dump"," command,\nwhich is the correct tool and an instruction you cannot follow: it assumes a\nterminal, a Postgres installation and a connection string, and you built this\napp in Lovable or Bolt precisely so you would never need any of the three.",[10,22,23],{},"You can get your data out of the dashboard instead. One route takes about ten\nminutes and gives you your rows. The other takes longer and gives you the\ndatabase.",[25,26,28],"h2",{"id":27},"does-the-supabase-free-tier-include-backups","Does the Supabase free tier include backups?",[10,30,31],{},"No. The free plan takes none at all, and there is no setting that switches them\non. Automatic daily backups begin on the Pro plan, and point-in-time recovery is\na paid add-on above that.",[10,33,34,35,40],{},"Which plan you are on is the fact everything else here depends on, and\n",[36,37,39],"a",{"href":38},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","it takes two minutes to check",". If you\nare on the free plan, the only copy of your data is one you made. The rest of\nthis article is how to make one today.",[25,42,44],{"id":43},"the-fastest-copy-export-your-tables-to-csv","The fastest copy: export your tables to CSV",[10,46,47],{},"Open the Table Editor, choose a table, and use the export control above the\ngrid. It offers to download every row as a CSV file, and that file arrives in\nyour downloads folder like anything else.",[10,49,50],{},"Then do it again for the next table, and the one after that. The export works on\none table at a time, which is the part that usually goes unmentioned: you have\nto know which tables your app has. The list down the left of the Table Editor is\nthat list, and it is worth reading to the bottom before you start.",[10,52,53],{},"Ten minutes of clicking gets you a folder of CSV files holding every row your\nusers have made. As a way of not losing your data this afternoon, that is a good\nuse of ten minutes. What you have at the end of it is a copy of the rows, and\nonly the rows.",[25,55,57],{"id":56},"what-the-csv-files-leave-behind","What the CSV files leave behind",[10,59,60],{},"Five things, and not one of them is a row. A CSV holds the contents of a table\nand nothing about how that table was built, so what you end up with is a list of\nwhat was in the room without any of the shelves.",[62,63,64,77],"table",{},[65,66,67],"thead",{},[68,69,70,74],"tr",{},[71,72,73],"th",{},"What stays behind",[71,75,76],{},"Why it matters when you put the data back",[78,79,80,89,97,105,117],"tbody",{},[68,81,82,86],{},[83,84,85],"td",{},"The relationships",[83,87,88],{},"A CSV has no idea which table has to be loaded first, so an import either fails or leaves rows pointing at things that are gone",[68,90,91,94],{},[83,92,93],{},"The column types",[83,95,96],{},"Everything arrives as text until something tells the new database otherwise, and an empty cell and a real null become the same",[68,98,99,102],{},[83,100,101],{},"Row Level Security policies",[83,103,104],{},"The rules that decide who can read what are not in the file, and a table recreated without them is either shut to everyone or open to everyone",[68,106,107,110],{},[83,108,109],{},"Your login accounts",[83,111,112,113,116],{},"They sit in a separate ",[17,114,115],{},"auth"," schema, which is why they are not in the Table Editor beside your own tables",[68,118,119,122],{},[83,120,121],{},"Everything your users uploaded",[83,123,124],{},"Supabase Storage lives outside the database, so no export of any table has ever contained a file",[126,127],"diagram",{"alt":128,"caption":129,"src":130},"On the left, three tables joined by lines, with a person and a padlock attached to them. On the right, the same content as three loose pages, ticked, and below a divider the joins, the padlock and the person drawn faintly and crossed out.","The rows come across. The lines between them, the rules on them and the people who log in do not.","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fwhat-csv-leaves-behind-1600x780.png",[10,132,133,134,138],{},"The last row is the one that surprises people. Your database only ever stored\nthe path to each uploaded file, so a folder of CSVs loaded into a fresh project\ngives you a table full of links to\n",[36,135,137],{"href":136},"\u002Fblog\u002Fsupabase-storage-bucket-public","files that are not there",".",[10,140,141],{},"This does not make the CSV route worthless. If what you are afraid of is a bad\ndelete on one table, a CSV of that table is the thing you want, and putting a\nfew hundred rows back through the same editor is a job you can do yourself. It\nis rebuilding the whole project that it cannot do.",[10,143,144,145,138],{},"While you are looking at your tables: our free scan reads your live site from\nthe outside and tells you which of them answer to a stranger. It takes about 20\nseconds and needs no account: ",[36,146,148],{"href":147},"\u002Fsecurity-scanner","scan your app",[25,150,152],{"id":151},"a-real-backup-without-opening-a-terminal","A real backup, without opening a terminal",[10,154,155,156,158],{},"Use a desktop database client. pgAdmin, TablePlus and DBeaver all connect to a\nSupabase project with a connection string, and all three have a backup or dump\ncommand sitting in a menu. What comes out is a full ",[17,157,19],{}," file, and you type\nno commands to get it.",[160,161,162,166,169,172],"ol",{},[163,164,165],"li",{},"In your Supabase dashboard, open Connect and copy a connection string. If the\ndirect one refuses to connect, take the session pooler string instead, which\nis the one Supabase's own restore instructions use.",[163,167,168],{},"Paste it into the client as a new connection, with your database password.",[163,170,171],{},"Find the backup command. In pgAdmin you right-click the database and choose\nBackup; in TablePlus and DBeaver it is under an export or dump menu.",[163,173,174],{},"Save the file somewhere that is not only your laptop.",[176,177,179],"callout",{"type":178},"warn",[10,180,181,185,186,188,189,191],{},[182,183,184],"strong",{},"The error you are most likely to hit."," These tools do not dump anything\nthemselves. They call the standard Postgres ",[17,187,19],{}," program installed on your\nmachine, and it refuses to run against a server newer than itself, complaining\nabout aborting because of a server version mismatch. The fix is to point the\nclient at a newer ",[17,190,19],{}," (in pgAdmin that is a binary path in preferences) or\nto install a more recent Postgres locally. It is an irritating half hour, and\nyou do it once.",[126,193],{"alt":194,"caption":195,"src":196},"A terminal window and a desktop application window, their two paths meeting at a single point and continuing as one arrow into one saved file.","Both routes ask Postgres for the same thing and produce the same file. One of them needs you to type it.","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fone-file-two-ways-1600x560.png",[10,198,199,200,204],{},"That file holds the room and the shelves: tables, columns, types, indexes,\nfunctions and your Row Level Security policies. Of the routes open to you on the\nfree plan it is the only one that can rebuild the project somewhere else, on a\ndifferent account, on a day when you cannot get into this one. Reading it back\nis its own job, and\n",[36,201,203],{"href":202},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","how to restore a Supabase backup"," goes\nthrough what a restore replaces and what it leaves broken behind it.",[25,206,208],{"id":207},"where-the-file-goes-and-how-often","Where the file goes, and how often",[10,210,211,212,216],{},"Somewhere that is not the same laptop and not the same Supabase account. Those\nare two different failures: the laptop covers a drive that dies, the account\ncovers a card that expired while you were away, a project suspended, a login\nnobody can recover. A copy inside the account is behind the same door as the\nthing it was protecting, which is what\n",[36,213,215],{"href":214},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","three ways to back up a Supabase database","\ncompares route by route.",[10,218,219],{},"For how often, ask how much you would be prepared to retype. Losing a day of\nsignups is annoying, so a copy each night covers it. Losing an hour of orders\nmeans refunding people, and nightly is already too slow for that.",[10,221,222],{},"Then load one of your copies into a throwaway Supabase project and open your app\nagainst it. That is the only step here that tells you whether the file is any\ngood, and it costs about half an hour.",[25,224,226],{"id":225},"if-you-would-rather-not-do-this-by-hand","If you would rather not do this by hand",[10,228,229],{},"Then something has to take the copy for you and check it afterwards. That is\nwhat Reeve Care does.",[126,231],{"alt":232,"caption":233,"src":234},"A Reeve Care panel with two rows. In the first, a copy of a database leaves a dashed outline of the Supabase account, repeats on a schedule and passes under a magnifier. In the second, the same file travels back into the account.","A copy leaves your Supabase account on a schedule, gets read back before it counts, and goes the other way on the day you need it.","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcare-backup-cycle-1600x520.png",[236,237,238,241,244,247,250],"ul",{},[163,239,240],{},"It runs on a schedule, several times a day depending on the plan, whether or\nnot anyone remembers.",[163,242,243],{},"The copy is encrypted and stored outside your Supabase account, so losing the\naccount does not take the backups with it.",[163,245,246],{},"Every copy is read back and counted against what went in. The date your\ndashboard shows is the last copy that passed that check, never the last one\nattempted.",[163,248,249],{},"Restoring is a button, and it takes a snapshot of the current state before it\nstarts, so even the restore has an undo.",[163,251,252],{},"Your uploaded files are copied as well, once you connect your Storage buckets.",[10,254,255,256,260,261,138],{},"Keep Supabase's own backups switched on too, the day you move to a paid plan.\nTwo copies in two places is the whole idea. What each plan includes is in the\n",[36,257,259],{"href":258},"\u002F#pricing","Care pricing table",", and the copy, the check and the restore are\ndrawn out step by step on the ",[36,262,264],{"href":263},"\u002Fsupabase-backups","Supabase backups page",[25,266,268],{"id":267},"what-to-do-this-week","What to do this week",[270,271,272],"key-takeaways",{},[236,273,274,277,280,283,286],{},[163,275,276],{},"Confirm which plan your project is on. On the free plan nothing is being copied for you, and everything else here follows from that.",[163,278,279],{},"Export your tables to CSV today if all you have is ten minutes. A partial copy beats no copy.",[163,281,282],{},"Take one full dump through a desktop client this week and put the file somewhere that is not your laptop.",[163,284,285],{},"Copy your Storage files separately. No database backup by any route includes them.",[163,287,288],{},"Load one copy into a throwaway project, so the first time you read that file is not the day you need it.",[10,290,291,292,296],{},"Do the CSV export before you close this tab. It is the smallest useful thing on\nthe list and it works on the plan you are already on. The\n",[36,293,295],{"href":294},"\u002Fchecklist","10-minute security checklist"," covers backups alongside the rest of\nwhat is worth confirming on a newly launched app.",{"title":298,"searchDepth":299,"depth":299,"links":300},"",3,[301,303,304,305,306,307,308],{"id":27,"depth":302,"text":28},2,{"id":43,"depth":302,"text":44},{"id":56,"depth":302,"text":57},{"id":151,"depth":302,"text":152},{"id":207,"depth":302,"text":208},{"id":225,"depth":302,"text":226},{"id":267,"depth":302,"text":268},"Backups","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcover-1200x630.png","A database, one table taken out of it, and a small stack of saved files at the end of an arrow.","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.",false,"md",[316,319,322,325,328],{"q":317,"a":318},"Can I download a backup from the Supabase dashboard on the free plan?","No. The backups page is a paid feature, and on the free plan there is nothing listed there to download, because nothing was ever taken. What you can download is your own data: the Table Editor exports any table as a CSV file, and a desktop database client connected to your project will write a full dump. Both are things you do rather than things that happen.",{"q":320,"a":321},"Is a CSV export a backup?","It is a partial one. A CSV file holds the rows of one table and nothing about how that table was built, so what you can rebuild from it is a spreadsheet rather than a database. Missing from it: the relationships between tables, the column types, your Row Level Security policies, your login accounts and every file your users uploaded. For putting back a table somebody emptied by accident it is exactly right. For rebuilding a project it is not enough.",{"q":323,"a":324},"How do I back up my Supabase auth users?","Your login accounts live in a separate database schema called auth, which is why they never appear in the Table Editor alongside your own tables and never end up in a CSV of them. A full dump can carry that schema. Getting those accounts working again in a different project is documented by Supabase as a job with its own steps rather than as something that rides along with your tables, so read that before you need it, not during.",{"q":326,"a":327},"My project is paused. Can I still get my data out?","Resume it first. Supabase pauses free projects after a period of low activity, and a paused project answers every request with an error until you restore it from the dashboard. A pause is not a deletion. Once the project is running again, both routes in this article work normally, and taking a copy at that point is the obvious next thing to do.",{"q":329,"a":330},"Should I just upgrade to Pro instead?","It is the cheapest way to get a daily copy taken automatically, and it is worth having. It does not replace holding a copy yourself, because the copies Supabase takes live inside the Supabase account. That covers you on the day you break your own data and not on the day you lose access to the account. If your app has real customers in it, the answer is usually both.","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",[333,334,335,336,337,338],"supabase free tier backups","supabase backup free","export supabase database","supabase backup without cli","download supabase database","back up supabase free plan",{},true,"Supabase free tier backups, without a terminal","\u002Fblog\u002Fback-up-supabase-free-tier","2026-08-30",{"title":5,"description":312},"blog\u002Fback-up-supabase-free-tier",[347,348,349],"There are no Supabase free tier backups. Nothing is copied anywhere on a schedule, so the only copy of your data is one you made.","The dashboard exports a table to CSV in a few clicks. That gets your rows out and leaves the structure behind: relationships, types, policies, logins, files.","For a copy that can rebuild the project, a desktop database client makes a full dump by pointing and clicking. No terminal involved.","8OYfgZRmI9XxeE5hJ6WZoVUzimLTSr0xrhqeB4oQp-k",[352,358,365,371,377,383,389,395,401,407,413,419,425,431,437,443,449,455,461,467,473,479,485,491,497,498,504,510,516,522,528,533,538,544,550,556,561,567,572,578,583,588],{"path":353,"title":354,"description":355,"published":356,"category":309,"image":357,"draft":313},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":359,"title":360,"description":361,"published":362,"category":363,"image":364,"draft":313},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","Security basics","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":366,"title":367,"description":368,"published":369,"category":363,"image":370,"draft":313},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":372,"title":373,"description":374,"published":375,"category":363,"image":376,"draft":313},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":378,"title":379,"description":380,"published":381,"category":363,"image":382,"draft":313},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":384,"title":385,"description":386,"published":387,"category":363,"image":388,"draft":313},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":390,"title":391,"description":392,"published":393,"category":363,"image":394,"draft":313},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":396,"title":397,"description":398,"published":399,"category":363,"image":400,"draft":313},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":402,"title":403,"description":404,"published":405,"category":363,"image":406,"draft":313},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":408,"title":409,"description":410,"published":411,"category":309,"image":412,"draft":313},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":414,"title":415,"description":416,"published":417,"category":309,"image":418,"draft":313},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":420,"title":421,"description":422,"published":423,"category":309,"image":424,"draft":313},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":426,"title":427,"description":428,"published":429,"category":363,"image":430,"draft":313},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":432,"title":433,"description":434,"published":435,"category":363,"image":436,"draft":313},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":438,"title":439,"description":440,"published":441,"category":363,"image":442,"draft":313},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":444,"title":445,"description":446,"published":447,"category":363,"image":448,"draft":313},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":450,"title":451,"description":452,"published":453,"category":363,"image":454,"draft":313},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Ten tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":456,"title":457,"description":458,"published":459,"category":363,"image":460,"draft":313},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":462,"title":463,"description":464,"published":465,"category":363,"image":466,"draft":313},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":468,"title":469,"description":470,"published":471,"category":363,"image":472,"draft":313},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":474,"title":475,"description":476,"published":477,"category":363,"image":478,"draft":313},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":480,"title":481,"description":482,"published":483,"category":363,"image":484,"draft":313},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":486,"title":487,"description":488,"published":489,"category":309,"image":490,"draft":313},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":492,"title":493,"description":494,"published":495,"category":363,"image":496,"draft":313},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":342,"title":5,"description":312,"published":343,"category":309,"image":331,"draft":313},{"path":499,"title":500,"description":501,"published":502,"category":363,"image":503,"draft":313},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":505,"title":506,"description":507,"published":508,"category":363,"image":509,"draft":313},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":511,"title":512,"description":513,"published":514,"category":363,"image":515,"draft":313},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":517,"title":518,"description":519,"published":520,"category":363,"image":521,"draft":313},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":523,"title":524,"description":525,"published":526,"category":309,"image":527,"draft":313},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":202,"title":529,"description":530,"published":531,"category":309,"image":532,"draft":313},"How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":136,"title":534,"description":535,"published":536,"category":363,"image":537,"draft":313},"Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":539,"title":540,"description":541,"published":542,"category":363,"image":543,"draft":313},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":545,"title":546,"description":547,"published":548,"category":309,"image":549,"draft":313},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":551,"title":552,"description":553,"published":554,"category":363,"image":555,"draft":313},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":557,"title":558,"description":559,"published":554,"category":363,"image":560,"draft":313},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":562,"title":563,"description":564,"published":565,"category":363,"image":566,"draft":313},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase's new API keys: which one is safe in your app?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":38,"title":568,"description":569,"published":570,"category":309,"image":571,"draft":313},"Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":573,"title":574,"description":575,"published":576,"category":363,"image":577,"draft":313},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":579,"title":580,"description":581,"published":576,"category":309,"image":582,"draft":313},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":214,"title":584,"description":585,"published":586,"category":309,"image":587,"draft":313},"Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":589,"title":590,"description":591,"published":586,"category":363,"image":592,"draft":313},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1790150951364]