[{"data":1,"prerenderedAt":1368},["ShallowReactive",2],{"blog-en-canceling-statement-due-to-statement-timeout":3,"blog-index-en":839},{"id":4,"title":5,"body":6,"category":797,"cover":798,"coverAlt":799,"description":800,"draft":801,"extension":802,"faq":803,"image":818,"keywords":819,"meta":827,"navigation":828,"ogTitle":829,"path":830,"published":831,"seo":832,"stem":833,"tldr":834,"updated":831,"__hash__":838},"blog_en\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout.md","Supabase \"canceling statement due to statement timeout\", explained",{"type":7,"value":8,"toc":783},"minimark",[9,13,24,27,30,35,38,57,60,64,67,70,149,159,162,168,172,179,195,203,224,227,236,240,247,262,268,279,286,289,293,296,299,405,408,415,425,429,432,440,446,466,471,477,495,512,526,532,538,541,547,559,564,568,571,577,584,590,601,605,608,635,657,665,669,675,684,704,713,730,734,776],[10,11,12],"p",{},"The page in your app loads its list, the spinner turns for a few seconds, and\nthen nothing. In the browser console, or in a red notice your builder added,\nthere is one line:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","canceling statement due to statement timeout\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26],{},"You open the same table in Supabase and every row is there. Ask the builder you\nmade the app with (Lovable, Bolt, v0, Cursor, Claude Code or Replit) which query\nthat page runs, paste it into the SQL Editor, and it comes back in a moment.",[10,28,29],{},"The advice you will find first for \"canceling statement due to statement\ntimeout\" in Supabase is to raise the limit. That limit is doing its job, and\nevery visitor to your app shares it. Before you raise anything, look at the Row\nLevel Security policy on that table, the rule Postgres checks before it hands\nover each row. In Supabase's own measurements, that rule is where a query that\nshould take 7 milliseconds spends 11 seconds.",[31,32,34],"h2",{"id":33},"what-does-canceling-statement-due-to-statement-timeout-mean-in-supabase","What does \"canceling statement due to statement timeout\" mean in Supabase?",[10,36,37],{},"Postgres, the database inside your Supabase project, stopped the query because\nit ran longer than the role that sent it is allowed, and undid whatever the\nquery had done.",[10,39,40,41,44,45,48,49,52,53,56],{},"The sentence comes from Postgres itself, with the error code ",[21,42,43],{},"57014",", which\nPostgres names ",[21,46,47],{},"query_canceled",". Supabase hands it to your app unchanged, so the\nerror your code receives carries ",[21,50,51],{},"code: '57014'"," and that sentence as its\nmessage. Postgres uses the same code for ",[21,54,55],{},"canceling statement due to user request",", which is a cancellation somebody asked for, so the sentence tells you\nmore than the number.",[10,58,59],{},"Picture your database as a library with a desk and a kitchen timer. Each time a\nvisitor asks for books, the librarian sets the timer before going to the\nshelves, and how long it runs depends on who is asking. When it rings, every\nbook goes back on the shelf and the visitor gets a slip with this sentence on\nit. If the request was to change something, the change is put back too.",[31,61,63],{"id":62},"why-does-the-query-work-in-the-sql-editor-and-fail-in-my-app","Why does the query work in the SQL Editor and fail in my app?",[10,65,66],{},"Because the SQL Editor asks as a different visitor, one with no timer of its own\nand no rules to check.",[10,68,69],{},"Every request reaches Postgres under a role, a name that decides what the\nrequest may do. Supabase's timeouts guide lists the limit each role starts\nwith:",[71,72,73,89],"table",{},[74,75,76],"thead",{},[77,78,79,83,86],"tr",{},[80,81,82],"th",{},"Who is asking",[80,84,85],{},"Role",[80,87,88],{},"Time allowed",[90,91,92,106,119,136],"tbody",{},[77,93,94,98,103],{},[95,96,97],"td",{},"A visitor to your app who is not signed in",[95,99,100],{},[21,101,102],{},"anon",[95,104,105],{},"3 seconds",[77,107,108,111,116],{},[95,109,110],{},"A signed-in user of your app",[95,112,113],{},[21,114,115],{},"authenticated",[95,117,118],{},"8 seconds",[77,120,121,124,129],{},[95,122,123],{},"Your server, with the secret key",[95,125,126],{},[21,127,128],{},"service_role",[95,130,131,132,135],{},"none of its own, so the 8 seconds of the ",[21,133,134],{},"authenticator"," role apply",[77,137,138,141,146],{},[95,139,140],{},"You, in the dashboard and the SQL Editor",[95,142,143],{},[21,144,145],{},"postgres",[95,147,148],{},"none of its own, capped by a 2-minute default",[10,150,151,152,154,155,158],{},"The editor's role has a second advantage. Supabase's Row Level Security guide\nsays that on Supabase ",[21,153,145],{}," has ",[21,156,157],{},"bypassrls",", the Postgres attribute that\nskips every policy. So the editor answers without reading a single rule. Your\napp's request reads every policy on the table against every row it looks at,\nwith a timer that rings at three seconds for a visitor who is not signed in.\nThe editor timed a different query from the one your app sends.",[10,160,161],{},"In the library you are staff. You walk into the stacks with no timer, and\nnobody checks a card. The visitor gets three seconds, and the librarian checks\nthe rules against every book on the way.",[163,164],"diagram",{"alt":165,"caption":166,"src":167},"The same query drawn as three bars on one time scale. For postgres the bar runs to its end with no checks along it and ends in a tick. For authenticated and anon the bar carries a check mark at every step; the authenticated bar ends in a tick before its 8 second line, and the anon bar is cut off in red at its 3 second line.","One query, three roles. The editor's role skips the policy and has no line to cross; a visitor who is not signed in runs every check and is stopped at three seconds.","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fthree-clocks-1600x720.png",[31,169,171],{"id":170},"find-the-query-that-was-cancelled","Find the query that was cancelled",[10,173,174,175,178],{},"Search your project's Postgres logs for the words ",[21,176,177],{},"statement timeout",", and note\nwhich role sent the query.",[10,180,181,182,186,187,190,191,194],{},"Supabase's timeouts guide gives a query for this. In the dashboard, open\n",[183,184,185],"strong",{},"Explorer",", choose ",[183,188,189],{},"Run SQL",", set the source to ",[183,192,193],{},"Logs",", pick a time range\nthat covers the failure, and run this shortened version of it:",[14,196,201],{"className":197,"code":199,"language":200,"meta":23},[198],"language-sql","select timestamp,\n       log_attributes['parsed.user_name'] as user_name,\n       log_attributes['parsed.query'] as query\nfrom logs\nwhere source = 'postgres_logs'\n  and match(event_message, 'statement timeout')\norder by timestamp desc\nlimit 100;\n","sql",[21,202,199],{"__ignoreMap":23},[10,204,205,206,209,210,212,213,216,217,219,220,223],{},"A ",[21,207,208],{},"user_name"," of ",[21,211,134],{}," means the request came through the Data API,\nthe server every ",[21,214,215],{},"supabase.from(…)"," call in your app goes through. The guide's\ntable of roles lists ",[21,218,134],{}," as PostgREST, which is that server. The\n",[21,221,222],{},"query"," column is the SQL your app's request turned into, and the table name in\nit is the table to look at.",[10,225,226],{},"The dashboard's Query Performance page is the other place people look, and the\nguide warns that it lists only slow queries that finished. A cancelled query is\nin the logs.",[10,228,229,230,235],{},"If the logs show cancellations on every table at once, the slow part is not one\npolicy, and\n",[231,232,234],"a",{"href":233},"\u002Fblog\u002Fis-supabase-down-or-your-app","telling a Supabase outage from a problem in your app","\nis the place to start.",[31,237,239],{"id":238},"time-it-the-way-your-app-runs-it","Time it the way your app runs it",[10,241,242,243,246],{},"Run the query as your app's role with ",[21,244,245],{},"explain analyze"," in front, and Postgres\nprints how long it took and how many rows the policy turned away.",[10,248,249,250,253,254,257,258,261],{},"This is the method in Supabase's guide to Row Level Security performance, inside\n",[21,251,252],{},"begin"," and ",[21,255,256],{},"rollback"," so the role change ends with the block. Copy a real user\nid from ",[183,259,260],{},"Authentication → Users"," in place of the zeros:",[14,263,266],{"className":264,"code":265,"language":200,"meta":23},[198],"begin;\nset local role authenticated;\nset local request.jwt.claims to '{\"role\":\"authenticated\", \"sub\":\"00000000-0000-0000-0000-000000000000\"}';\nexplain analyze select * from public.orders;\nrollback;\n",[21,267,265],{"__ignoreMap":23},[10,269,270,271,274,275,278],{},"Two lines of the output matter. ",[21,272,273],{},"Execution Time"," is the number to hold against\n3 and 8 seconds. ",[21,276,277],{},"Rows Removed by Filter"," counts the rows Postgres read and the\npolicy refused, and Supabase's guide calls it the signal to watch: a policy that\nremoves most of the table on every read is a policy whose filter column needs\nan index.",[10,280,281,282,285],{},"To time what a visitor who is not signed in gets, write ",[21,283,284],{},"set local role anon;","\nand leave out the claims line.",[10,287,288],{},"The same guide suggests running the query once with Row Level Security on and\nonce with it off, to see whether the policy is the cost. It also says to do that\nonly outside production, because switching it off exposes every row. On a live\napp, time the policy against its rewritten version instead.",[31,290,292],{"id":291},"how-can-a-policy-cost-seconds","How can a policy cost seconds?",[10,294,295],{},"Postgres checks the policy against every row the query reads, and a function\ncall in the policy runs again for every one of those rows.",[10,297,298],{},"Supabase published timings for this, measured on a table of 100,000 rows. Four\nof them, the slow way and the fast way:",[71,300,301,319],{},[74,302,303],{},[77,304,305,308,311,314,317],{},[80,306,307],{},"What the policy checks",[80,309,310],{},"Written as",[80,312,313],{},"Took",[80,315,316],{},"Rewritten as",[80,318,313],{},[90,320,321,342,363,384],{},[77,322,323,326,331,334,339],{},[95,324,325],{},"Rows that belong to the signed-in user",[95,327,328],{},[21,329,330],{},"auth.uid() = user_id",[95,332,333],{},"179 ms",[95,335,336],{},[21,337,338],{},"(select auth.uid()) = user_id",[95,340,341],{},"9 ms",[77,343,344,347,351,354,360],{},[95,345,346],{},"The same rule, with no index on the column",[95,348,349],{},[21,350,330],{},[95,352,353],{},"171 ms",[95,355,356,357],{},"the same, with an index on ",[21,358,359],{},"user_id",[95,361,362],{},"under 0.1 ms",[77,364,365,368,373,376,381],{},[95,366,367],{},"An admin check that reads another table",[95,369,370],{},[21,371,372],{},"is_admin()",[95,374,375],{},"11,000 ms",[95,377,378],{},[21,379,380],{},"(select is_admin())",[95,382,383],{},"7 ms",[77,385,386,389,394,397,402],{},[95,387,388],{},"A role looked up in another table",[95,390,391],{},[21,392,393],{},"has_role() = role",[95,395,396],{},"178,000 ms",[95,398,399],{},[21,400,401],{},"(select has_role()) = role",[95,403,404],{},"12 ms",[10,406,407],{},"The first two are slow and still inside three seconds on that table. The last\ntwo are past every limit an app request has. A helper function that reads a\nsecond table, the kind people write to check whether somebody is an admin, is\ncalled once for each row of the first, so on that table it read the second one\n100,000 times.",[10,409,410,411,414],{},"In the library, that helper is the librarian walking to the front office to ask\nwhether you are staff, once for every book on the shelf. Wrapping it in\n",[21,412,413],{},"(select …)"," is asking once and writing the answer on the slip.",[10,416,417,418],{},"Supabase's Performance Advisor catches part of this. Its rule named Auth RLS\nInitialization Plan reports a policy that \"re-evaluates current_setting() or\nauth.",[419,420,421,422,424],"function",{},"() for each row\". A helper of your own, such as ",[21,423,372],{},", is\noutside that description, so an advisor page with nothing on it has not\nchecked your helpers. Read the policies on the table yourself for any function\ncall that is not wrapped.",[31,426,428],{"id":427},"fix-it-in-this-order","Fix it in this order",[10,430,431],{},"Wrap the function calls, index the column the policy compares, then name the\nrole. Each one is a short piece of SQL you can run in the editor or paste to\nyour builder.",[10,433,434],{},[183,435,436,437,439],{},"1. Wrap every function call in ",[21,438,413],{},".",[14,441,444],{"className":442,"code":443,"language":200,"meta":23},[198],"alter policy \"read own orders\" on public.orders\n  using ( (select auth.uid()) = user_id );\n",[21,445,443],{"__ignoreMap":23},[10,447,448,451,452,455,456,460,461,465],{},[21,449,450],{},"alter policy"," keeps the policy's name and its role and replaces the condition.\nUse your policy's name and your table's column, and do the same to a helper:\n",[21,453,454],{},"(select private.is_admin())",". Supabase attaches one condition: it only works\nfor a value that stays the same from row to row. Why the brackets matter is in\n",[231,457,459],{"href":458},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","the guide to enabling Row Level Security",",\nand a helper written to\n",[231,462,464],{"href":463},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","clear an infinite recursion error","\nis exactly the kind that needs them.",[10,467,468],{},[183,469,470],{},"2. Index the column the policy compares.",[14,472,475],{"className":473,"code":474,"language":200,"meta":23},[198],"create index orders_user_id_idx on public.orders (user_id);\n",[21,476,474],{"__ignoreMap":23},[10,478,479,480,483,484,486,487,490,491,494],{},"Supabase's guide adds a catch. A column counts as indexed only when it comes\nfirst in the index, so a table whose primary key is ",[21,481,482],{},"(team_id, user_id)"," has no\nindex on ",[21,485,359],{},". On a large table that is being written to while you work,\nthe Postgres documentation says a plain ",[21,488,489],{},"create index"," locks the table against\nwrites until it is built. ",[21,492,493],{},"create index concurrently"," builds it without that\nlock, and it has to run as a statement on its own, outside a transaction.",[10,496,497,500,501,504,505,508,509,511],{},[183,498,499],{},"3. Name the role the policy is for."," A policy written ",[21,502,503],{},"to authenticated"," is\nnever run for a visitor who is not signed in. In Supabase's timings, a signed-out\nrequest against a policy with no ",[21,506,507],{},"to"," took 170 ms, and with ",[21,510,503],{},"\nit took under 0.1 ms.",[10,513,514,517,518,521,522,525],{},[183,515,516],{},"4. Filter in the request as well."," A policy works like an invisible ",[21,519,520],{},"where","\non every query, and Supabase's guide recommends repeating it in your app's\nrequest, ",[21,523,524],{},".eq('user_id', userId)",", because Postgres can plan a faster query\nwith it. In their timings that took a query from 171 ms to 9.",[10,527,528,531],{},[183,529,530],{},"5. Take the join out of a team policy."," A policy that matches each row\nagainst a membership table runs that lookup per row:",[14,533,536],{"className":534,"code":535,"language":200,"meta":23},[198],"using ( (select auth.uid()) in (\n  select user_id from team_user where team_user.team_id = projects.team_id\n) )\n",[21,537,535],{"__ignoreMap":23},[10,539,540],{},"Supabase's guide rewrites it to read the teams once and compare against that\nlist:",[14,542,545],{"className":543,"code":544,"language":200,"meta":23},[198],"using ( team_id in (\n  select team_id from team_user where user_id = (select auth.uid())\n) )\n",[21,546,544],{"__ignoreMap":23},[10,548,549,550,552,553,555,556,558],{},"Then run the ",[21,551,245],{}," from earlier again, and compare ",[21,554,273],{},"\nand ",[21,557,277],{}," with what you had before.",[163,560],{"alt":561,"caption":562,"src":563},"Two shelves of the same twelve rows. On the left, a scan line runs past every row and a check mark sits beside each one, and three of them are lit. On the right, an index card with three tabs points straight to the same three lit rows, and the rest carry no mark.","Without an index the policy reads every row to find the few that belong to you. With one, Postgres goes straight to them.","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fevery-row-or-the-few-1600x700.png",[31,565,567],{"id":566},"should-i-raise-the-statement-timeout","Should I raise the statement timeout?",[10,569,570],{},"Only for a query you have measured, rewritten and still need, and then for that\none function rather than for a whole role.",[10,572,573,574,576],{},"The limits are deliberate. Supabase's import guide says it enforces them \"to\nensure fair resource allocation and prevent long-running queries from affecting\nthe overall system\". The ",[21,575,102],{}," limit is shared by every visitor who is not\nsigned in, and anyone can send that request with the publishable key that ships\nin your app. Raising it from three seconds to thirty gives each of those\nrequests thirty seconds of your database.",[10,578,579,580,583],{},"When a job really does take longer, give the limit to the function that runs\nit. Supabase's guide describes this for \"recurring functions that need a special\nexemption for runtimes\", and it works for a function your app calls with\n",[21,581,582],{},"supabase.rpc(…)",":",[14,585,588],{"className":586,"code":587,"language":200,"meta":23},[198],"alter function public.monthly_totals() set statement_timeout to '20s';\n",[21,589,587],{"__ignoreMap":23},[10,591,592,593,596,597,600],{},"If you do change a role, the guide's commands are\n",[21,594,595],{},"alter role authenticated set statement_timeout = '15s';"," and then\n",[21,598,599],{},"notify pgrst, 'reload config';",", so the Data API picks the new value up.\nSupabase caps queries from its client libraries at 60 seconds whatever you set.",[31,602,604],{"id":603},"two-fixes-that-stop-the-message-and-open-the-table","Two fixes that stop the message and open the table",[10,606,607],{},"Switching Row Level Security off on the table, and sending the request with the\nsecret key. Both make the query fast because both skip the policy, and both\nhand the rows to people you never meant to have them.",[10,609,610,613,614,617,618,621,622,621,625,253,628,631,632,634],{},[183,611,612],{},"Switching it off."," With no policy to run, nothing is checked per row and the\ntimeout goes away. Supabase prints its own caution beside the test that\nsuggests it: disabling Row Level Security exposes every row in the table to any\nrole with a matching grant. Its guide also says that on existing projects a new\ntable in ",[21,615,616],{},"public"," starts with ",[21,619,620],{},"select",", ",[21,623,624],{},"insert",[21,626,627],{},"update",[21,629,630],{},"delete"," granted\nto ",[21,633,102],{},", the role of a visitor who is not signed in. With the policy gone,\nthose grants are all that stands between that visitor and the table.",[10,636,637,640,641,643,644,646,647,651,652,654,655,439],{},[183,638,639],{},"The secret key."," Supabase's guide says the ",[21,642,128],{}," role behind it has\n",[21,645,157],{}," as well, so no policy runs. That key belongs on a server, and one\nsent from the browser is a key anyone can read out of your site;\n",[231,648,650],{"href":649},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","which keys are safe in a frontend","\ngoes through the pair. It does not buy much time either, because the guide gives\n",[21,653,128],{}," the same 8 seconds as ",[21,656,134],{},[10,658,659,660,664],{},"Whether any table of yours answers a request carrying no login at all is one of\nthe nine checks in ",[231,661,663],{"href":662},"\u002Fsecurity-scanner","Reeve's free scan",". It reads your live\nsite the way a visitor does, takes about 20 seconds and needs no account.",[31,666,668],{"id":667},"keeping-the-policy-quick-and-the-table-closed","Keeping the policy quick and the table closed",[10,670,671,674],{},[183,672,673],{},"A policy you fixed today has a next version."," Your builder writes policies\nwhenever a feature needs one, so the next rule it writes can call a function\nper row again, or open the table to make a screen load.",[10,676,677],{},[183,678,679,683],{},[231,680,682],{"href":681},"\u002Fwebsite-monitoring","Reeve Monitor"," checks your app from outside, every hour:",[685,686,687,691,694,701],"ul",{},[688,689,690],"li",{},"all nine checks every hour, including whether any table answers a request with no login",[688,692,693],{},"whether the app is up, every 60 seconds",[688,695,696,697,700],{},"a message when a result ",[183,698,699],{},"changes",", so a table that starts answering strangers does not wait for you to look",[688,702,703],{},"a monthly report of what it saw",[10,705,706],{},[183,707,708,712],{},[231,709,711],{"href":710},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database from\nbefore you changed it:",[685,714,715,718,721,724,727],{},[688,716,717],{},"an encrypted copy on a schedule, kept on Reeve's own storage in the EU, outside your Supabase account",[688,719,720],{},"each copy verified before it counts, by counting the rows in every table",[688,722,723],{},"a one-click restore that saves what is there now before it replaces anything",[688,725,726],{},"your uploaded files as well, once you connect a Storage credential",[688,728,729],{},"everything Monitor does",[31,731,733],{"id":732},"what-to-do-today","What to do today",[735,736,737],"key-takeaways",{},[685,738,739,745,761,767,773],{},[688,740,741,742,744],{},"Search the Postgres logs for ",[21,743,177],{}," and note the query and the role that sent it.",[688,746,747,748,750,751,753,754,756,757,253,759,439],{},"Time that query with ",[21,749,245],{}," as ",[21,752,102],{}," or ",[21,755,115],{},", the roles your app uses, and read ",[21,758,273],{},[21,760,277],{},[688,762,763,764,766],{},"Wrap every function call in that table's policies in ",[21,765,413],{},", including helpers of your own that the Performance Advisor does not flag.",[688,768,769,770,772],{},"Index the column each policy compares, and add ",[21,771,503],{}," to every policy meant only for signed-in users.",[688,774,775],{},"Raise a limit last, on the one function that needs it, and leave Row Level Security on.",[10,777,778,779,782],{},"Start with the table behind the page that failed. If it has no policies of its\nown yet,\n",[231,780,781],{"href":458},"enabling Row Level Security on every table","\nhas the three shapes most tables need.",{"title":23,"searchDepth":784,"depth":784,"links":785},3,[786,788,789,790,791,792,793,794,795,796],{"id":33,"depth":787,"text":34},2,{"id":62,"depth":787,"text":63},{"id":170,"depth":787,"text":171},{"id":238,"depth":787,"text":239},{"id":291,"depth":787,"text":292},{"id":427,"depth":787,"text":428},{"id":566,"depth":787,"text":567},{"id":603,"depth":787,"text":604},{"id":667,"depth":787,"text":668},{"id":732,"depth":787,"text":733},"Security basics","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcover-1200x630.png","A stopwatch whose hand has swept past its mark, in front of a long shelf of rows with a check mark beside only the first few.","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.",false,"md",[804,806,809,812,815],{"q":34,"a":805},"Postgres stopped your query because it ran longer than the role that sent it is allowed, and undid whatever it had done. Supabase gives a visitor who is not signed in 3 seconds and a signed-in user 8. The error carries the code 57014, which Postgres also uses for a query cancelled on request, so read the sentence as well as the number.",{"q":807,"a":808},"Why does my query work in the SQL Editor but time out in my app?","Because the SQL Editor runs as the postgres role, and your app does not. Supabase gives postgres no timeout of its own, and the role has bypassrls, so the editor never runs your Row Level Security policies. Your app runs as anon or authenticated, with a 3 or 8 second limit and every policy checked against every row the query reads.",{"q":810,"a":811},"Can Row Level Security cause a statement timeout?","Yes. Postgres checks the policy against each row the query reads, and a function call in the policy runs again for each of them. In timings Supabase published for a 100,000-row table, a policy calling an is_admin() helper took 11,000 milliseconds, and the same policy with the call wrapped as (select is_admin()) took 7.",{"q":813,"a":814},"How do I increase the statement timeout in Supabase?","For one slow job, set it on the function that runs it with alter function … set statement_timeout. For a whole role, run alter role with the new statement_timeout, then notify pgrst, 'reload config' so the Data API picks it up. Supabase caps queries from its client libraries at 60 seconds. Fix the policy first, because the anon limit is shared by every visitor who is not signed in.",{"q":816,"a":817},"Should I turn off RLS to make the query faster?","No. The query gets faster because no policy runs, and the table is then open to every role with a grant on it. Supabase's guide says a new table in public on existing projects starts with select, insert, update and delete granted to anon, the role of a visitor who is not signed in. Wrap the function calls and add an index instead.","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",[820,821,822,823,824,825,826],"canceling statement due to statement timeout supabase","canceling statement due to statement timeout","supabase statement timeout","57014 supabase","supabase query timeout anon","supabase rls slow","supabase increase statement timeout",{},true,"Supabase \"canceling statement due to statement timeout\"","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","2026-10-31",{"title":5,"description":800},"blog\u002Fcanceling-statement-due-to-statement-timeout",[835,836,837],"\"canceling statement due to statement timeout\" in Supabase means Postgres stopped a query because it ran longer than the role that sent it is allowed: 3 seconds for a visitor who is not signed in, 8 for one who is. Nothing the query was doing is kept.","The same query works in the SQL Editor because the editor runs as the postgres role, which has no limit of its own and skips your Row Level Security policies altogether. Your app runs every policy against every row it reads.","Fix the policy before you touch the limit: wrap function calls in (select …), index the column the policy compares, and name the role. A higher limit for visitors gives every stranger longer with your database.","F5lDtACrl5xSG_OxUpsxWxj-9nKcw6EDyIX7hpNYuxQ",[840,846,852,858,864,870,876,882,888,894,895,902,908,914,920,926,932,938,944,950,956,962,968,974,980,986,992,998,1004,1010,1016,1022,1028,1033,1039,1045,1051,1057,1063,1069,1074,1080,1086,1092,1098,1104,1109,1115,1121,1127,1133,1139,1145,1151,1157,1163,1169,1175,1181,1187,1193,1199,1204,1210,1216,1222,1228,1234,1240,1246,1252,1258,1264,1270,1276,1282,1288,1294,1300,1306,1312,1318,1324,1330,1335,1341,1347,1353,1358,1364],{"path":841,"title":842,"description":843,"published":844,"category":797,"image":845,"draft":801},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":847,"title":848,"description":849,"published":850,"category":797,"image":851,"draft":801},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":853,"title":854,"description":855,"published":856,"category":797,"image":857,"draft":801},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":859,"title":860,"description":861,"published":862,"category":797,"image":863,"draft":801},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":865,"title":866,"description":867,"published":868,"category":797,"image":869,"draft":801},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":871,"title":872,"description":873,"published":874,"category":797,"image":875,"draft":801},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":877,"title":878,"description":879,"published":880,"category":797,"image":881,"draft":801},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":883,"title":884,"description":885,"published":886,"category":797,"image":887,"draft":801},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":889,"title":890,"description":891,"published":892,"category":797,"image":893,"draft":801},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":830,"title":5,"description":800,"published":831,"category":797,"image":818,"draft":801},{"path":896,"title":897,"description":898,"published":899,"category":900,"image":901,"draft":801},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":903,"title":904,"description":905,"published":906,"category":797,"image":907,"draft":801},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":909,"title":910,"description":911,"published":912,"category":797,"image":913,"draft":801},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":915,"title":916,"description":917,"published":918,"category":797,"image":919,"draft":801},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":921,"title":922,"description":923,"published":924,"category":797,"image":925,"draft":801},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":927,"title":928,"description":929,"published":930,"category":797,"image":931,"draft":801},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":933,"title":934,"description":935,"published":936,"category":797,"image":937,"draft":801},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":939,"title":940,"description":941,"published":942,"category":797,"image":943,"draft":801},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":945,"title":946,"description":947,"published":948,"category":797,"image":949,"draft":801},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":951,"title":952,"description":953,"published":954,"category":797,"image":955,"draft":801},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":957,"title":958,"description":959,"published":960,"category":797,"image":961,"draft":801},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":963,"title":964,"description":965,"published":966,"category":797,"image":967,"draft":801},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":969,"title":970,"description":971,"published":972,"category":797,"image":973,"draft":801},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":975,"title":976,"description":977,"published":978,"category":797,"image":979,"draft":801},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":981,"title":982,"description":983,"published":984,"category":797,"image":985,"draft":801},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":987,"title":988,"description":989,"published":990,"category":797,"image":991,"draft":801},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":993,"title":994,"description":995,"published":996,"category":797,"image":997,"draft":801},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":999,"title":1000,"description":1001,"published":1002,"category":797,"image":1003,"draft":801},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":1005,"title":1006,"description":1007,"published":1008,"category":797,"image":1009,"draft":801},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1011,"title":1012,"description":1013,"published":1014,"category":797,"image":1015,"draft":801},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":1017,"title":1018,"description":1019,"published":1020,"category":797,"image":1021,"draft":801},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":1023,"title":1024,"description":1025,"published":1026,"category":797,"image":1027,"draft":801},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":463,"title":1029,"description":1030,"published":1031,"category":797,"image":1032,"draft":801},"\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":1034,"title":1035,"description":1036,"published":1037,"category":797,"image":1038,"draft":801},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":1040,"title":1041,"description":1042,"published":1043,"category":797,"image":1044,"draft":801},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":1046,"title":1047,"description":1048,"published":1049,"category":797,"image":1050,"draft":801},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":1052,"title":1053,"description":1054,"published":1055,"category":797,"image":1056,"draft":801},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":1058,"title":1059,"description":1060,"published":1061,"category":797,"image":1062,"draft":801},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":1064,"title":1065,"description":1066,"published":1067,"category":797,"image":1068,"draft":801},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":233,"title":1070,"description":1071,"published":1072,"category":797,"image":1073,"draft":801},"Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":1075,"title":1076,"description":1077,"published":1078,"category":797,"image":1079,"draft":801},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":1081,"title":1082,"description":1083,"published":1084,"category":797,"image":1085,"draft":801},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":1087,"title":1088,"description":1089,"published":1090,"category":900,"image":1091,"draft":801},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":1093,"title":1094,"description":1095,"published":1096,"category":900,"image":1097,"draft":801},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":1099,"title":1100,"description":1101,"published":1102,"category":900,"image":1103,"draft":801},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":1105,"title":1106,"description":1107,"published":1102,"category":797,"image":1108,"draft":801},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":1110,"title":1111,"description":1112,"published":1113,"category":797,"image":1114,"draft":801},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":1116,"title":1117,"description":1118,"published":1119,"category":797,"image":1120,"draft":801},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":1122,"title":1123,"description":1124,"published":1125,"category":900,"image":1126,"draft":801},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":1128,"title":1129,"description":1130,"published":1131,"category":797,"image":1132,"draft":801},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":1134,"title":1135,"description":1136,"published":1137,"category":797,"image":1138,"draft":801},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":1140,"title":1141,"description":1142,"published":1143,"category":797,"image":1144,"draft":801},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":1146,"title":1147,"description":1148,"published":1149,"category":797,"image":1150,"draft":801},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":1152,"title":1153,"description":1154,"published":1155,"category":797,"image":1156,"draft":801},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":1158,"title":1159,"description":1160,"published":1161,"category":797,"image":1162,"draft":801},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1164,"title":1165,"description":1166,"published":1167,"category":797,"image":1168,"draft":801},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1170,"title":1171,"description":1172,"published":1173,"category":797,"image":1174,"draft":801},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1176,"title":1177,"description":1178,"published":1179,"category":900,"image":1180,"draft":801},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1182,"title":1183,"description":1184,"published":1185,"category":900,"image":1186,"draft":801},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1188,"title":1189,"description":1190,"published":1191,"category":900,"image":1192,"draft":801},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1194,"title":1195,"description":1196,"published":1197,"category":797,"image":1198,"draft":801},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":458,"title":1200,"description":1201,"published":1202,"category":797,"image":1203,"draft":801},"Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1205,"title":1206,"description":1207,"published":1208,"category":797,"image":1209,"draft":801},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1211,"title":1212,"description":1213,"published":1214,"category":797,"image":1215,"draft":801},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1217,"title":1218,"description":1219,"published":1220,"category":797,"image":1221,"draft":801},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1223,"title":1224,"description":1225,"published":1226,"category":797,"image":1227,"draft":801},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1229,"title":1230,"description":1231,"published":1232,"category":797,"image":1233,"draft":801},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1235,"title":1236,"description":1237,"published":1238,"category":797,"image":1239,"draft":801},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1241,"title":1242,"description":1243,"published":1244,"category":797,"image":1245,"draft":801},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1247,"title":1248,"description":1249,"published":1250,"category":797,"image":1251,"draft":801},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1253,"title":1254,"description":1255,"published":1256,"category":900,"image":1257,"draft":801},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1259,"title":1260,"description":1261,"published":1262,"category":797,"image":1263,"draft":801},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1265,"title":1266,"description":1267,"published":1268,"category":900,"image":1269,"draft":801},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1271,"title":1272,"description":1273,"published":1274,"category":797,"image":1275,"draft":801},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1277,"title":1278,"description":1279,"published":1280,"category":797,"image":1281,"draft":801},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1283,"title":1284,"description":1285,"published":1286,"category":797,"image":1287,"draft":801},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1289,"title":1290,"description":1291,"published":1292,"category":797,"image":1293,"draft":801},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1295,"title":1296,"description":1297,"published":1298,"category":900,"image":1299,"draft":801},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1301,"title":1302,"description":1303,"published":1304,"category":900,"image":1305,"draft":801},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1307,"title":1308,"description":1309,"published":1310,"category":797,"image":1311,"draft":801},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1313,"title":1314,"description":1315,"published":1316,"category":797,"image":1317,"draft":801},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1319,"title":1320,"description":1321,"published":1322,"category":900,"image":1323,"draft":801},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1325,"title":1326,"description":1327,"published":1328,"category":797,"image":1329,"draft":801},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1331,"title":1332,"description":1333,"published":1328,"category":797,"image":1334,"draft":801},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1336,"title":1337,"description":1338,"published":1339,"category":797,"image":1340,"draft":801},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1342,"title":1343,"description":1344,"published":1345,"category":900,"image":1346,"draft":801},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1348,"title":1349,"description":1350,"published":1351,"category":797,"image":1352,"draft":801},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1354,"title":1355,"description":1356,"published":1351,"category":900,"image":1357,"draft":801},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1359,"title":1360,"description":1361,"published":1362,"category":900,"image":1363,"draft":801},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":649,"title":1365,"description":1366,"published":1362,"category":797,"image":1367,"draft":801},"Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]