[{"data":1,"prerenderedAt":1057},["ShallowReactive",2],{"blog-en-certificate-not-trusted":3,"blog-index-en":526},{"id":4,"title":5,"body":6,"category":483,"cover":484,"coverAlt":485,"description":486,"draft":487,"extension":488,"faq":489,"image":505,"keywords":506,"meta":514,"navigation":515,"ogTitle":516,"path":517,"published":518,"seo":519,"stem":520,"tldr":521,"updated":518,"__hash__":525},"blog_en\u002Fblog\u002Fcertificate-not-trusted.md","Certificate not trusted: the three causes besides expiry",{"type":7,"value":8,"toc":469},"minimark",[9,13,16,25,30,33,36,39,131,134,137,141,144,160,187,190,201,205,208,211,239,245,248,252,255,258,261,264,268,271,274,277,282,300,304,307,310,335,340,343,361,365,368,371,378,386,390,393,401,412,421,432,436,461],[10,11,12],"p",{},"Your app loaded fine yesterday. Today somebody sends you a screenshot of a\nfull-page browser warning, \"Your connection is not private\", and asks whether\nyour site has been hacked. You open the certificate and it is valid until next\nspring. It has not expired, and you are still looking at a certificate not\ntrusted by the browser.",[10,14,15],{},"The obvious move is to renew it, and for this screen it is the wrong one. Each\nof the three causes below happens to a certificate that is already in date, so\na renewal gets you a later expiry date on a certificate that is still refused\nfor some other reason.",[10,17,18,19,24],{},"In ",[20,21,23],"a",{"href":22},"\u002Fblog\u002Fdomain-and-certificate-expiry","our post on expiry",", the certificate is\nthe licence in the shop window, saying this shop really is the one on the sign.\nA visitor's browser reads three things on that licence before it lets anybody\nin: the date, the name of the shop it was issued to, and the signature of\nwhoever issued it. Expiry is the date. This article is about the other two.",[26,27,29],"h2",{"id":28},"why-is-my-certificate-not-trusted-when-it-has-not-expired","Why is my certificate not trusted when it has not expired?",[10,31,32],{},"Because the name or the signature failed, and the browser puts up the same wall\nfor every one of its checks.",[10,34,35],{},"A certificate is trusted only when it names the exact address in the visitor's\naddress bar and was signed by an authority the browser already trusts, with\nevery certificate in between sent along. Fail either and Chrome shows \"Your\nconnection is not private\" and Firefox \"Warning: Potential Security Risk\nAhead\", exactly as they do for an expired one.",[10,37,38],{},"What differs is the small print under the warning. Read it before you change\nanything:",[40,41,42,61],"table",{},[43,44,45],"thead",{},[46,47,48,52,55,58],"tr",{},[49,50,51],"th",{},"What Chrome prints",[49,53,54],{},"What Firefox says after Advanced",[49,56,57],{},"What it means",[49,59,60],{},"What fixes it",[62,63,64,82,98,113],"tbody",{},[46,65,66,73,76,79],{},[67,68,69],"td",{},[70,71,72],"code",{},"NET::ERR_CERT_COMMON_NAME_INVALID",[67,74,75],{},"The certificate is \"not valid for\" your address",[67,77,78],{},"It was issued to a different name",[67,80,81],{},"A certificate that lists your exact address",[46,83,84,89,92,95],{},[67,85,86],{},[70,87,88],{},"NET::ERR_CERT_AUTHORITY_INVALID",[67,90,91],{},"\"The certificate is not trusted because it is self-signed\"",[67,93,94],{},"Nobody vouches for it but the server itself",[67,96,97],{},"A certificate from a real authority",[46,99,100,104,107,110],{},[67,101,102],{},[70,103,88],{},[67,105,106],{},"\"its certificate issuer is unknown\"",[67,108,109],{},"The browser cannot connect it to an authority it trusts",[67,111,112],{},"The full chain, from a recognised authority",[46,114,115,120,123,126],{},[67,116,117],{},[70,118,119],{},"NET::ERR_CERT_DATE_INVALID",[67,121,122],{},"The certificate has expired",[67,124,125],{},"The date",[67,127,128],{},[20,129,130],{"href":22},"A new certificate",[10,132,133],{},"Chrome prints one code for the second and third rows, which is why the\ncertificate itself is worth opening.",[10,135,136],{},"If one person reports the warning and nobody else can see it, ask which network\nthey were on. Chrome's source code lists a wifi network that sends its users to\na sign-in page as one cause of the name error. That one clears when they sign\nin to the network.",[26,138,140],{"id":139},"how-do-i-see-what-the-certificate-says","How do I see what the certificate says?",[10,142,143],{},"Open it from the warning and read two fields: who it was issued to, and who\nissued it.",[10,145,146,147,151,152,155,156,159],{},"In Chrome, click ",[148,149,150],"strong",{},"Not secure"," at the left of the address bar and open the\ncertificate from the panel that appears. In Firefox, click ",[148,153,154],{},"Advanced"," on the\nwarning, then ",[148,157,158],{},"View the site's certificate",". The two browsers label the same\nfields differently:",[161,162,163,178],"ul",{},[164,165,166,169,170,173,174,177],"li",{},[148,167,168],{},"Issued To"," in Chrome, ",[148,171,172],{},"Subject Name"," in Firefox, is the name the\ncertificate was made for. The full list of names it covers sits under\n",[148,175,176],{},"Subject Alternative Name",", and that list is what the browser compares with\nthe address.",[164,179,180,169,183,186],{},[148,181,182],{},"Issued By",[148,184,185],{},"Issuer Name"," in Firefox, is the authority that\nsigned it.",[10,188,189],{},"Each of the three causes reads differently there:",[161,191,192,195,198],{},[164,193,194],{},"The certificate names some other address. That is cause 1.",[164,196,197],{},"Issued To and Issued By are the same name. It signed itself, which is cause 2.",[164,199,200],{},"It names your address, the issuer is an authority you have heard of, and the\nbrowser still refuses it. That is cause 3, the chain.",[26,202,204],{"id":203},"cause-1-the-certificate-is-for-a-different-address","Cause 1: the certificate is for a different address",[10,206,207],{},"The certificate is genuine and in date, and it was issued for another name. It\nis the licence of a different shop, hanging in your window.",[10,209,210],{},"It comes in three shapes:",[161,212,213,219,233],{},[164,214,215,218],{},[148,216,217],{},"Your domain points at a host that has no certificate for it yet."," The host\nanswers with the certificate it does have, issued to a name of its own.\nLovable's documentation says so plainly: until the certificate is ready, \"the\nbrowser shows a security warning instead of your site.\"",[164,220,221,224,225,228,229,232],{},[148,222,223],{},"The certificate covers one spelling of your address and the visitor typed\nthe other."," ",[70,226,227],{},"www.yourapp.com"," and ",[70,230,231],{},"yourapp.com"," are two names to a\ncertificate, and each one has to be on its list.",[164,234,235,238],{},[148,236,237],{},"Part of your DNS still points at a place you left."," An old host, or the\nparking page your registrar showed before you connected anything, answers on\nthat name with a certificate of its own.",[240,241],"diagram",{"alt":242,"caption":243,"src":244},"Two rows. In each, an address bar holding yourapp.com sits beside a certificate card listing the names it covers. In the top row the card lists only www.yourapp.com, and the row ends in a cross. In the bottom row the card lists both names, and the row ends in a tick.","To a certificate, the address with www and the one without are two names. The address in the bar has to be on the list.","\u002Fblog\u002Fcertificate-not-trusted\u002Fone-name-missing-1600x660.png",[10,246,247],{},"On Lovable and Vercel you do not buy or install this certificate yourself. The\nhost issues one for each name you add in its domain settings, once your DNS\npoints that name at the host. Lovable's documentation adds that a certificate\nbought from your registrar is not used by its hosting at all. Add both\nspellings, point both at the host, and wait until each shows as live.",[26,249,251],{"id":250},"cause-2-the-certificate-signed-itself","Cause 2: the certificate signed itself",[10,253,254],{},"Nobody vouches for this certificate except the server presenting it. It is a\nlicence the shopkeeper printed at home.",[10,256,257],{},"Every browser refuses one on a public site, and is meant to. A comment in\nChrome's source code puts the reason in one line: a self-signed certificate\nprovides no defence against an attacker sitting between your visitor and your\napp.",[10,259,260],{},"You meet it on servers somebody set up by hand: a rented server, a self-hosted\ntool, a test setting that went live with the app. A builder issues real\ncertificates for the domains you add to it, so a self-signed certificate on a\nbuilder-hosted app means something other than the builder is answering on your\naddress. Check where your DNS points before you change anything else.",[10,262,263],{},"The fix is a certificate from a real authority. Let's Encrypt issues them free,\nand it is the authority Vercel uses when it issues yours.",[26,265,267],{"id":266},"cause-3-a-link-in-the-chain-was-never-sent","Cause 3: a link in the chain was never sent",[10,269,270],{},"The certificate is for your address and was signed by a real authority, and\nthe server sent it without the certificate in between, so the browser cannot\nconnect it to anybody it trusts. The licence was signed by a branch office, and\nthe letter from head office vouching for that branch is missing from the\nwindow.",[10,272,273],{},"Mozilla calls a missing intermediate certificate \"one of the most common server\nconfiguration problems\". Firefox now downloads a copy of every trusted\nintermediate in advance, so that its users stop meeting the error.",[10,275,276],{},"That is what makes this cause hard to see: it can look fine on your laptop and\nfail for somebody else. A browser holding its own copy of the missing link\nfills the gap. Software that uses only what your server sends has nothing to\nfill it with. Our scanner is that kind of software, which is why it can report\na certificate as untrusted while your own browser shows a padlock.",[240,278],{"alt":279,"caption":280,"src":281},"A server sends a certificate to two visitors. Between the certificate and the trusted authority there should be a second certificate, and the server has not sent it. The first visitor holds a copy of the missing certificate and gets a tick. The second holds nothing and gets a cross.","The same incomplete chain, sent to two visitors. Only the one who already had the missing link can complete it.","\u002Fblog\u002Fcertificate-not-trusted\u002Fthe-missing-link-1600x700.png",[10,283,284,285,288,289,292,293,299],{},"On a builder the chain is handled for you. It goes missing on servers\nconfigured by hand, and the fix there is to serve the certificate followed by\nthe intermediate, in one file. If you use Let's Encrypt's certbot, that file is\n",[70,286,287],{},"fullchain.pem",", and the mistake is pointing your server at ",[70,290,291],{},"cert.pem"," instead.\nTo check from outside, ",[20,294,298],{"href":295,"rel":296},"https:\u002F\u002Fwww.ssllabs.com\u002Fssltest\u002F",[297],"nofollow","SSL Labs' free server test","\nreports a missing intermediate as a chain issue.",[26,301,303],{"id":302},"the-custom-domain-case-in-order","The custom-domain case, in order",[10,305,306],{},"When you connect your own domain to a builder, visitors see this warning until\nthe host has a certificate for your name, and the warning is telling the truth.\nIt ends by itself once the certificate is issued.",[10,308,309],{},"The order, on Lovable:",[311,312,313,322,325,328],"ol",{},[164,314,315,316,318,319,321],{},"Add the domain in Lovable. It sets up both ",[70,317,231],{}," and\n",[70,320,227],{}," and lists them separately.",[164,323,324],{},"Change the DNS records at your registrar to the values Lovable gives you.\nLovable says most updates are live within a few hours, and that propagation\ncan take up to 72.",[164,326,327],{},"Lovable verifies the domain and issues the certificate. Vercel works the same\nway: it proves to Let's Encrypt that the name is yours, automatically, as\nlong as the domain points at Vercel.",[164,329,330,331,334],{},"Open the site once the domain shows as ",[148,332,333],{},"Live",", which is Lovable's own\nadvice.",[240,336],{"alt":337,"caption":338,"src":339},"A timeline. A figure points a name at a host, and from that moment an amber stretch with a warning mark runs until a seal marks the certificate being issued, after which the line turns accent with a padlock. A rule further along is numbered 72.","Between pointing your domain at the host and the certificate arriving, the warning is correct. Lovable asks you to contact support if it is still there after 72 hours.","\u002Fblog\u002Fcertificate-not-trusted\u002Fthe-wait-is-the-warning-1600x560.png",[10,341,342],{},"If the warning is still there after 72 hours, Lovable asks you to contact its\nsupport. Two settings are worth checking before you write:",[161,344,345,355],{},[164,346,347,350,351,354],{},[148,348,349],{},"Look for a CAA record."," It is a DNS entry naming which authorities may\nissue certificates for your domain. One that leaves out your host's authority\nblocks the\ncertificate, and a subdomain inherits the parent domain's CAA records when it\nhas none of its own. ",[20,352,353],{"href":22},"The expiry post","\nmeets the same record as a reason a renewal fails; here it stops the first\ncertificate from ever being issued.",[164,356,357,360],{},[148,358,359],{},"Look for a proxy in front."," If your DNS is at Cloudflare with the orange\ncloud switched on for the records your host gave you, Cloudflare answers\ninstead of your host. Lovable says it then cannot verify the domain or issue\ncertificates for it, and Lovable and Vercel both say to set those records to\nDNS only.",[26,362,364],{"id":363},"what-we-found-across-30879-apps","What we found across 30,879 apps",[10,366,367],{},"Eight had a certificate that no browser would trust, and every one of them was\non a domain its owner had connected.",[10,369,370],{},"In August 2026 our scan read the certificate of 30,879 live apps: 29,927 on a\nbuilder's own subdomain and 952 on a domain of their own. All eight untrusted\ncertificates were among the 952, a little under one in a hundred. None of the\napps on a builder's subdomain had one, which fits everything above. On the\nbuilder's own address, the builder owns both the name and the certificate.",[10,372,373,374,377],{},"Our finding records that the certificate failed and not which of the three\ncauses it was, so we cannot tell you how the eight divide. The expired and\nexpiring certificates from the same scan are counted in\n",[20,375,376],{"href":22},"the expiry post",".",[10,379,380,381,385],{},"To check your own app, ",[20,382,384],{"href":383},"\u002Fsecurity-scanner","our free scan"," reads the certificate\nyour server sends, from outside, and names this finding when it sees it. It takes about 20 seconds and needs no account.",[26,387,389],{"id":388},"catching-it-the-next-time-something-changes","Catching it the next time something changes",[10,391,392],{},"A certificate goes from trusted to refused when something around it changes: a\nnew domain, a DNS move, a proxy switched on. The check that matters is the one\nthat runs after the change.",[10,394,395,400],{},[148,396,397],{},[20,398,399],{"href":383},"Scan your app free"," to see what a visitor's browser is\nhanded today.",[161,402,403,406,409],{},[164,404,405],{},"Reads the certificate your server sends, from outside, along with eight other\nchecks.",[164,407,408],{},"Names the finding when the certificate is untrusted, and when it is expired or\nclose to it.",[164,410,411],{},"About 20 seconds, and no account.",[10,413,414,420],{},[148,415,416],{},[20,417,419],{"href":418},"\u002Fwebsite-monitoring","Reeve Monitor"," to hear about it soon after it changes.",[161,422,423,426,429],{},[164,424,425],{},"Checks your app every 60 seconds, and a certificate it cannot trust counts as\nyour app being down, so you are told the way you would be about an outage.",[164,427,428],{},"Re-runs all nine checks every hour, and emails you when your grade drops.",[164,430,431],{},"Covers up to three apps.",[26,433,435],{"id":434},"what-to-do-right-now","What to do right now",[437,438,439],"key-takeaways",{},[161,440,441,444,447,455,458],{},[164,442,443],{},"Read the code under the warning before you renew anything. A date error needs a new certificate. A name or authority error needs something else.",[164,445,446],{},"Open the certificate and compare the name it was issued to with the address in the bar, and with the name of whoever issued it.",[164,448,449,450,228,452,454],{},"On a builder, add both ",[70,451,231],{},[70,453,227],{}," in its domain settings and point both at it.",[164,456,457],{},"If a new domain still shows the warning after 72 hours, look for a CAA record or a proxy in front of the host before you contact support.",[164,459,460],{},"On a server you run yourself, serve the full chain and check it from outside with SSL Labs.",[10,462,463,464,468],{},"When the warning has gone and the app still does not load, the next question is\nwhether it is your app or the platform under it, and\n",[20,465,467],{"href":466},"\u002Fblog\u002Fis-supabase-down-or-your-app","is Supabase down, or is it your app"," walks\nthrough how to tell.",{"title":470,"searchDepth":471,"depth":471,"links":472},"",3,[473,475,476,477,478,479,480,481,482],{"id":28,"depth":474,"text":29},2,{"id":139,"depth":474,"text":140},{"id":203,"depth":474,"text":204},{"id":250,"depth":474,"text":251},{"id":266,"depth":474,"text":267},{"id":302,"depth":474,"text":303},{"id":363,"depth":474,"text":364},{"id":388,"depth":474,"text":389},{"id":434,"depth":474,"text":435},"Security basics","\u002Fblog\u002Fcertificate-not-trusted\u002Fcover-1200x630.png","A certificate card with its seal and date lit in accent, under an address bar whose name is longer than the amber name on the card.","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.",false,"md",[490,493,496,499,502],{"q":491,"a":492},"Why does my site say \"not private\" when my certificate has not expired?","Because the date is one of three things a browser checks, and the other two fail on their own. The certificate also has to name the exact address the visitor typed, and it has to be signed by an authority the browser trusts, with every certificate in between sent along. A certificate that fails either check gets the same full-page warning an expired one does, and renewing it changes nothing.",{"q":494,"a":495},"What is a certificate name mismatch?","A certificate issued for one address, presented on another. Chrome reports it as NET::ERR_CERT_COMMON_NAME_INVALID and Firefox says the certificate is not valid for your address. The certificate itself is usually real and in date. It belongs to a different name, often your host's own, which is what a host answers with on your domain before it has issued one for you.",{"q":497,"a":498},"Why does www work and the bare domain not?","Because to a certificate they are two different names. Either the certificate lists only one of them, or the DNS for the other still points somewhere else, such as your registrar's parking page or an old host, which answers with a certificate of its own. Lovable connects both and lists them separately, so check that each one shows as live.",{"q":500,"a":501},"How long does a custom domain certificate take?","Lovable says domain setup typically completes within a few minutes but can take up to several hours, that DNS changes may take up to 72 hours to propagate, and to contact its support if the certificate has not been issued after 72 hours. Until it is issued, visitors see a security warning instead of your site.",{"q":503,"a":504},"Is a self-signed certificate ever fine?","On your own machine, for development, yes. On a site the public visits, no. Every visitor's browser refuses it, and Chrome's own source code notes that a self-signed certificate provides no defence against an attacker sitting between the visitor and the site.","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",[507,508,509,510,511,512,513],"certificate not trusted","ssl certificate not trusted browser","your connection is not private custom domain","certificate name mismatch","self-signed certificate website warning","net::err_cert_common_name_invalid","net::err_cert_authority_invalid",{},true,"Certificate not trusted: three causes besides expiry","\u002Fblog\u002Fcertificate-not-trusted","2026-10-26",{"title":5,"description":486},"blog\u002Fcertificate-not-trusted",[522,523,524],"A certificate not trusted by browsers can be perfectly in date. It is refused because it names a different address, because it signed itself, or because it arrived without the certificate that vouches for it.","The warning screen is the same one an expired certificate gets, and renewing fixes none of the three. The code printed under the warning tells you which one you have.","On Lovable and Vercel, a custom domain shows this warning until its certificate is issued. That wait is normal. A warning that outlasts it means something is stopping the certificate.","AzwQDMxA-ag1ddRPe8FlTZsQfTGlc3vzuMgVLKk5z_Y",[527,533,539,545,551,557,563,569,575,581,587,594,600,606,612,613,619,625,631,637,643,649,655,661,667,673,679,685,691,697,703,709,715,721,727,733,739,745,751,757,762,768,774,780,786,792,797,803,809,815,820,826,832,838,844,850,856,862,868,874,880,886,892,898,904,910,916,922,928,934,940,946,952,958,964,970,976,982,988,994,1000,1006,1012,1018,1023,1029,1035,1041,1046,1052],{"path":528,"title":529,"description":530,"published":531,"category":483,"image":532,"draft":487},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":534,"title":535,"description":536,"published":537,"category":483,"image":538,"draft":487},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":540,"title":541,"description":542,"published":543,"category":483,"image":544,"draft":487},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":546,"title":547,"description":548,"published":549,"category":483,"image":550,"draft":487},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":552,"title":553,"description":554,"published":555,"category":483,"image":556,"draft":487},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":558,"title":559,"description":560,"published":561,"category":483,"image":562,"draft":487},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":564,"title":565,"description":566,"published":567,"category":483,"image":568,"draft":487},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":570,"title":571,"description":572,"published":573,"category":483,"image":574,"draft":487},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":576,"title":577,"description":578,"published":579,"category":483,"image":580,"draft":487},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":582,"title":583,"description":584,"published":585,"category":483,"image":586,"draft":487},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":588,"title":589,"description":590,"published":591,"category":592,"image":593,"draft":487},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":595,"title":596,"description":597,"published":598,"category":483,"image":599,"draft":487},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":601,"title":602,"description":603,"published":604,"category":483,"image":605,"draft":487},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":607,"title":608,"description":609,"published":610,"category":483,"image":611,"draft":487},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":517,"title":5,"description":486,"published":518,"category":483,"image":505,"draft":487},{"path":614,"title":615,"description":616,"published":617,"category":483,"image":618,"draft":487},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":620,"title":621,"description":622,"published":623,"category":483,"image":624,"draft":487},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":626,"title":627,"description":628,"published":629,"category":483,"image":630,"draft":487},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":632,"title":633,"description":634,"published":635,"category":483,"image":636,"draft":487},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":638,"title":639,"description":640,"published":641,"category":483,"image":642,"draft":487},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":644,"title":645,"description":646,"published":647,"category":483,"image":648,"draft":487},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":650,"title":651,"description":652,"published":653,"category":483,"image":654,"draft":487},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":656,"title":657,"description":658,"published":659,"category":483,"image":660,"draft":487},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":662,"title":663,"description":664,"published":665,"category":483,"image":666,"draft":487},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":668,"title":669,"description":670,"published":671,"category":483,"image":672,"draft":487},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":674,"title":675,"description":676,"published":677,"category":483,"image":678,"draft":487},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":680,"title":681,"description":682,"published":683,"category":483,"image":684,"draft":487},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":686,"title":687,"description":688,"published":689,"category":483,"image":690,"draft":487},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":692,"title":693,"description":694,"published":695,"category":483,"image":696,"draft":487},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":698,"title":699,"description":700,"published":701,"category":483,"image":702,"draft":487},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":704,"title":705,"description":706,"published":707,"category":483,"image":708,"draft":487},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":710,"title":711,"description":712,"published":713,"category":483,"image":714,"draft":487},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":716,"title":717,"description":718,"published":719,"category":483,"image":720,"draft":487},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":722,"title":723,"description":724,"published":725,"category":483,"image":726,"draft":487},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":728,"title":729,"description":730,"published":731,"category":483,"image":732,"draft":487},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":734,"title":735,"description":736,"published":737,"category":483,"image":738,"draft":487},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":740,"title":741,"description":742,"published":743,"category":483,"image":744,"draft":487},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":746,"title":747,"description":748,"published":749,"category":483,"image":750,"draft":487},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":752,"title":753,"description":754,"published":755,"category":483,"image":756,"draft":487},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":466,"title":758,"description":759,"published":760,"category":483,"image":761,"draft":487},"Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":763,"title":764,"description":765,"published":766,"category":483,"image":767,"draft":487},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":769,"title":770,"description":771,"published":772,"category":483,"image":773,"draft":487},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":775,"title":776,"description":777,"published":778,"category":592,"image":779,"draft":487},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":781,"title":782,"description":783,"published":784,"category":592,"image":785,"draft":487},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":787,"title":788,"description":789,"published":790,"category":592,"image":791,"draft":487},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":793,"title":794,"description":795,"published":790,"category":483,"image":796,"draft":487},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":798,"title":799,"description":800,"published":801,"category":483,"image":802,"draft":487},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":804,"title":805,"description":806,"published":807,"category":483,"image":808,"draft":487},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":810,"title":811,"description":812,"published":813,"category":592,"image":814,"draft":487},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":22,"title":816,"description":817,"published":818,"category":483,"image":819,"draft":487},"Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":821,"title":822,"description":823,"published":824,"category":483,"image":825,"draft":487},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":827,"title":828,"description":829,"published":830,"category":483,"image":831,"draft":487},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":833,"title":834,"description":835,"published":836,"category":483,"image":837,"draft":487},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":839,"title":840,"description":841,"published":842,"category":483,"image":843,"draft":487},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":845,"title":846,"description":847,"published":848,"category":483,"image":849,"draft":487},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":851,"title":852,"description":853,"published":854,"category":483,"image":855,"draft":487},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":857,"title":858,"description":859,"published":860,"category":483,"image":861,"draft":487},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":863,"title":864,"description":865,"published":866,"category":592,"image":867,"draft":487},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":869,"title":870,"description":871,"published":872,"category":592,"image":873,"draft":487},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":875,"title":876,"description":877,"published":878,"category":592,"image":879,"draft":487},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":881,"title":882,"description":883,"published":884,"category":483,"image":885,"draft":487},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":887,"title":888,"description":889,"published":890,"category":483,"image":891,"draft":487},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":893,"title":894,"description":895,"published":896,"category":483,"image":897,"draft":487},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":899,"title":900,"description":901,"published":902,"category":483,"image":903,"draft":487},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":905,"title":906,"description":907,"published":908,"category":483,"image":909,"draft":487},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":911,"title":912,"description":913,"published":914,"category":483,"image":915,"draft":487},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":917,"title":918,"description":919,"published":920,"category":483,"image":921,"draft":487},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":923,"title":924,"description":925,"published":926,"category":483,"image":927,"draft":487},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":929,"title":930,"description":931,"published":932,"category":483,"image":933,"draft":487},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":935,"title":936,"description":937,"published":938,"category":483,"image":939,"draft":487},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":941,"title":942,"description":943,"published":944,"category":592,"image":945,"draft":487},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":947,"title":948,"description":949,"published":950,"category":483,"image":951,"draft":487},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":953,"title":954,"description":955,"published":956,"category":592,"image":957,"draft":487},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":959,"title":960,"description":961,"published":962,"category":483,"image":963,"draft":487},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":965,"title":966,"description":967,"published":968,"category":483,"image":969,"draft":487},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":971,"title":972,"description":973,"published":974,"category":483,"image":975,"draft":487},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":977,"title":978,"description":979,"published":980,"category":483,"image":981,"draft":487},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":983,"title":984,"description":985,"published":986,"category":592,"image":987,"draft":487},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":989,"title":990,"description":991,"published":992,"category":592,"image":993,"draft":487},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":995,"title":996,"description":997,"published":998,"category":483,"image":999,"draft":487},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1001,"title":1002,"description":1003,"published":1004,"category":483,"image":1005,"draft":487},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1007,"title":1008,"description":1009,"published":1010,"category":592,"image":1011,"draft":487},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1013,"title":1014,"description":1015,"published":1016,"category":483,"image":1017,"draft":487},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1019,"title":1020,"description":1021,"published":1016,"category":483,"image":1022,"draft":487},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1024,"title":1025,"description":1026,"published":1027,"category":483,"image":1028,"draft":487},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1030,"title":1031,"description":1032,"published":1033,"category":592,"image":1034,"draft":487},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1036,"title":1037,"description":1038,"published":1039,"category":483,"image":1040,"draft":487},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1042,"title":1043,"description":1044,"published":1039,"category":592,"image":1045,"draft":487},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1047,"title":1048,"description":1049,"published":1050,"category":592,"image":1051,"draft":487},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1053,"title":1054,"description":1055,"published":1050,"category":483,"image":1056,"draft":487},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]