[{"data":1,"prerenderedAt":1145},["ShallowReactive",2],{"blog-en-database-error-deleting-user":3,"blog-index-en":619},{"id":4,"title":5,"body":6,"category":577,"cover":578,"coverAlt":579,"description":580,"draft":581,"extension":582,"faq":583,"image":598,"keywords":599,"meta":607,"navigation":608,"ogTitle":609,"path":610,"published":611,"seo":612,"stem":613,"tldr":614,"updated":611,"__hash__":618},"blog_en\u002Fblog\u002Fdatabase-error-deleting-user.md","\"Database error deleting user\" in Supabase, and what goes with it",{"type":7,"value":8,"toc":563},"minimark",[9,13,24,27,34,39,42,59,65,69,72,75,98,101,120,124,131,134,140,155,166,181,184,192,206,210,213,219,222,225,231,234,238,241,305,321,324,330,333,347,352,356,365,378,392,398,402,405,433,444,451,455,458,474,477,485,489,495,503,525,529,555],[10,11,12],"p",{},"You open Authentication → Users in your Supabase dashboard and delete an\naccount. Maybe the person asked you to remove them, maybe it is a test account\nyou made last week. The dashboard answers:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","Failed to delete user: Database error deleting user\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26],{},"The account is still in the list. The app you built with Lovable, Bolt, v0,\nCursor, Claude Code or Replit has worked all along, and the sentence names no\ntable and no reason.",[10,28,29,30,33],{},"The answer you will find first is one line of SQL: add ",[21,31,32],{},"on delete cascade"," to\nwhatever is in the way. It works. It also decides, for every account deleted\nfrom then on, which other rows are deleted with it, and nothing asks you about\nthat again. So read the real error first, and then make that decision one table\nat a time.",[35,36,38],"h2",{"id":37},"what-does-database-error-deleting-user-mean-in-supabase","What does \"Database error deleting user\" mean in Supabase?",[10,40,41],{},"Your database refused the delete, and Supabase undid all of it, so the account\nis exactly as it was.",[10,43,44,45,48,49,52,53,58],{},"Deleting a user is a job for Supabase Auth, the service behind your app's\nsign-in. In Auth's own source code the delete runs inside one transaction, a\ngroup of changes that either all happen or none do, and its central step removes\nthe person's row from ",[21,46,47],{},"auth.users",". If anything in your database objects to\nthat, the transaction is rolled back and Auth replies with this one sentence.\nSupabase lists it as HTTP 500 with the code ",[21,50,51],{},"unexpected_failure",", beside its twin\nfor signups,\n",[54,55,57],"a",{"href":56},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\"",".",[10,60,61,62,64],{},"Think of your database as a members' club. ",[21,63,47],{}," is the roll of members,\nand every member has a number: their user id. Your other books copy that number\nonto their lines, whether it is a profile, an order, a post or a comment.\nStriking someone off the roll takes one line. Every other book still carries the\nnumber, though, and unless somebody wrote down what to do about those lines, the\nclub's secretary refuses.",[35,66,68],{"id":67},"where-is-the-real-error","Where is the real error?",[10,70,71],{},"In your project's Postgres logs, at the moment the delete failed.",[10,73,74],{},"Supabase's troubleshooting note for the user-management errors gives the route.\nTry the delete once and note the time. Then, in the dashboard:",[76,77,78,91],"ol",{},[79,80,81,82,86,87,90],"li",{},"Open ",[83,84,85],"strong",{},"Logs"," and read the ",[83,88,89],{},"Auth"," logs at that time. The entry is Auth's own\nrecord of the failed delete.",[79,92,93,94,97],{},"Open the ",[83,95,96],{},"Postgres"," logs at the same time. That line is the real error, and\nit names a table, a rule or a permission.",[10,99,100],{},"The same note lists three causes, and the log line tells you which one you have:",[102,103,104,110,115],"ul",{},[79,105,106,107,109],{},"a trigger on the ",[21,108,47],{}," table that fails",[79,111,112,113],{},"a constraint that is not being met, which on a delete means a foreign key in\nanother table pointing at ",[21,114,47],{},[79,116,117,118],{},"Prisma, which the note says can break the permissions on ",[21,119,47],{},[35,121,123],{"id":122},"a-table-that-still-points-at-the-user","A table that still points at the user",[10,125,126,127,130],{},"If the Postgres line says ",[21,128,129],{},"violates foreign key constraint",", a row in one of your\ntables still holds this user's id, and Postgres will not remove a person that\nsomething still points at.",[10,132,133],{},"Supabase's note prints the shape it takes:",[14,135,138],{"className":136,"code":137,"language":19},[17],"ERROR:  23503: update or delete on table \"users\" violates foreign key constraint \"profiles_id_fkey\" on table \"profiles\"\nDETAIL:  Key (id)=(7428a53c-75b7-4531-9ae9-1567d9c4ac0a) is still referenced from table \"profiles\".\n",[21,139,137],{"__ignoreMap":23},[10,141,142,143,146,147,150,151,154],{},"A foreign key is a rule on a column saying that every value in it must exist in\nanother table. Here the rule is called ",[21,144,145],{},"profiles_id_fkey",", it lives on your\n",[21,148,149],{},"profiles"," table, and the ",[21,152,153],{},"Key"," line is the id of the user you tried to delete.\nIn the club, that is a line in the profiles book carrying the member's number,\nand the secretary refusing to strike them off while it is there.",[10,156,157,158,161,162,58],{},"The same rule refuses a save from the other side. A new row that names a user\nwho does not exist comes back as\n",[21,159,160],{},"insert or update on table … violates foreign key constraint",", and\n",[54,163,165],{"href":164},"\u002Fblog\u002Fviolates-foreign-key-constraint","that message has a post of its own",[10,167,168,169,172,173,176,177,180],{},"The refusal is the default. A foreign key created with nothing after\n",[21,170,171],{},"references auth.users"," gets the behaviour Postgres calls ",[21,174,175],{},"no action",", and\nSupabase's guide to cascade deletes says so in as many words: ",[21,178,179],{},"NO ACTION"," is the\ndefault behaviour if you do not specify anything. A table your builder created\nthat way works perfectly until the first time somebody is deleted.",[10,182,183],{},"To see every table that points at your users, and what each one does on a\ndelete, run this in the SQL Editor:",[14,185,190],{"className":186,"code":188,"language":189,"meta":23},[187],"language-sql","select conrelid::regclass as table_name,\n       conname as rule,\n       case confdeltype\n         when 'c' then 'cascade'\n         when 'n' then 'set null'\n         when 'd' then 'set default'\n         when 'r' then 'restrict'\n         else 'no action'\n       end as on_delete\nfrom pg_constraint\nwhere contype = 'f'\n  and confrelid = 'auth.users'::regclass\n  and connamespace \u003C> 'auth'::regnamespace;\n","sql",[21,191,188],{"__ignoreMap":23},[10,193,194,195,198,199,201,202,205],{},"It reads Postgres's own catalogue and changes nothing. The last line leaves out\nSupabase's own tables in the ",[21,196,197],{},"auth"," schema. Each row that says ",[21,200,175],{}," or\n",[21,203,204],{},"restrict"," is a table that will refuse the delete whenever it holds a row for\nthat user.",[35,207,209],{"id":208},"what-does-on-delete-cascade-delete","What does on delete cascade delete?",[10,211,212],{},"Every row that points at the user, then every row that points at those, on every\ndelete from then on.",[10,214,215,216,218],{},"It is the fix you are handed first, and Supabase's user-management guide uses it\nfor a profiles table: \"Specify ",[21,217,32],{}," in the reference.\" For a\nprofile it is right. A profile describes the person and nothing else, so it\nshould leave when they do.",[10,220,221],{},"The trouble starts when the same words go on every table. Supabase's cascade\nguide describes the behaviour plainly: when a row is deleted from the parent\ntable, all related rows in the child tables are deleted as well. It also carries\non down. In that guide's own example, a single delete from the top table empties\nthe two tables beneath it.",[10,223,224],{},"In the club, a cascade tells the secretary to tear out every line carrying the\nmember's number, and then every line in any other book that pointed at a torn-out\nline. Picture a user who wrote posts, with other people's comments pointing at\nthose posts. With cascade on both, deleting that one user removes their posts\nand everybody else's comments on them.",[226,227],"diagram",{"alt":228,"caption":229,"src":230},"Three ledgers in a row joined by arrows. One line is struck from the member roll on the left. In the middle ledger, the two lines carrying that member's number tag are torn out. In the right ledger, the lines pointing at those two are torn out as well, and most of them carry other members' tags in other colours.","A cascade follows every rule pointing at the deleted row, then every rule pointing at those. The last ledger loses rows that belonged to other people.","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fthe-chain-1600x700.png",[10,232,233],{},"Nothing tells you what went with it. Auth answers a successful delete with an\nempty reply, the dashboard shows one account fewer, and the rows that left at\nthe same moment are missing the next time anybody looks for them.",[35,235,237],{"id":236},"choosing-what-each-table-keeps","Choosing what each table keeps",[10,239,240],{},"Decide per table, because each one holds something different about the person\nwho left.",[242,243,244,262],"table",{},[245,246,247],"thead",{},[248,249,250,254,259],"tr",{},[251,252,253],"th",{},"What the table holds",[251,255,256],{},[21,257,258],{},"on delete",[251,260,261],{},"When the user is deleted",[263,264,265,279,292],"tbody",{},[248,266,267,271,276],{},[268,269,270],"td",{},"Only the person: a profile, their settings",[268,272,273],{},[21,274,275],{},"cascade",[268,277,278],{},"The rows go with them",[248,280,281,284,289],{},[268,282,283],{},"Things other people still need: a comment in someone else's thread, a payment record",[268,285,286],{},[21,287,288],{},"set null",[268,290,291],{},"The rows stay, with the owner column empty",[248,293,294,297,302],{},[268,295,296],{},"Anything you want to deal with by hand first",[268,298,299,301],{},[21,300,175],{}," (the default)",[268,303,304],{},"The delete is refused while those rows remain",[10,306,307,309,310,316,317,320],{},[21,308,288],{}," comes with two conditions. The column has to allow empty values, or\nthe delete fails again with a message of its own,\n",[54,311,313],{"href":312},"\u002Fblog\u002Fnull-value-violates-not-null-constraint",[21,314,315],{},"null value in column … violates not-null constraint",". And a policy written as\n",[21,318,319],{},"user_id = auth.uid()"," will never show that row to anybody again, because in SQL\nnothing is equal to an empty value. The row is kept, and your app stops showing\nit to anyone.",[10,322,323],{},"Changing a rule means dropping it and adding it back with the new behaviour,\nwhich is what Supabase's note recommends:",[14,325,328],{"className":326,"code":327,"language":189,"meta":23},[187],"alter table public.profiles\n  drop constraint profiles_id_fkey,\n  add constraint profiles_id_fkey\n    foreign key (id) references auth.users (id) on delete cascade;\n",[21,329,327],{"__ignoreMap":23},[10,331,332],{},"Use the rule name the query above printed, with your own table and column.",[10,334,335,336,339,340,343,344,346],{},"There is one more way, and it keeps every row. Supabase Auth can soft-delete an\naccount: ",[21,337,338],{},"auth.admin.deleteUser()"," takes a ",[21,341,342],{},"shouldSoftDelete"," option, and with\nit Auth keeps the row in ",[21,345,47],{},", marks it deleted, scrambles the email and\nphone, clears the password and the metadata, and ends the sessions. Nothing was\nremoved, so no foreign key fires. It runs from a server with your secret key,\nnever from the browser.",[226,348],{"alt":349,"caption":350,"src":351},"The same deleted member drawn three times, one lane each for no action, cascade and set null. In the first lane a barrier stops the delete and the member's line and the line pointing at it both stay. In the second the line pointing at the member is torn out with it. In the third that line stays, with an empty dashed slot where the member's tag was.","The same delete under three rules. The first refuses and changes nothing, the second takes the line pointing at the member with it, and the third keeps that line with an empty slot.","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fthree-outcomes-1600x760.png",[35,353,355],{"id":354},"a-trigger-that-cannot-reach-your-table","A trigger that cannot reach your table",[10,357,126,358,361,362,364],{},[21,359,360],{},"permission denied for table",", a trigger on\n",[21,363,47],{}," ran during the delete and tried to touch a table it is not allowed\ninto.",[10,366,367,368,371,372,374,375,58],{},"The role Supabase Auth works as, ",[21,369,370],{},"supabase_auth_admin",", only has the permissions\nits own job needs. Supabase's note puts it this way: when a trigger operated by\n",[21,373,370],{}," interacts outside the auth schema, it causes a permission\nerror. A trigger that tidies up after a deleted account, say by writing to a log\ntable of your own, fails exactly like that unless its function was created with\n",[21,376,377],{},"security definer",[10,379,380,381,383,384,387,388,391],{},"The repair is the one for signups: a ",[21,382,377],{}," function, created by the\n",[21,385,386],{},"postgres"," role, doing one narrow thing.\n",[54,389,390],{"href":56},"The signup version of this error"," goes\nthrough it line by line, including the empty search path that keeps it safe.",[10,393,394,395,397],{},"If your app uses Prisma, read the third cause in Supabase's note before anything\nelse, because it names Prisma as a way the permissions on ",[21,396,47],{}," get\nbroken.",[35,399,401],{"id":400},"what-happens-to-the-files-they-uploaded","What happens to the files they uploaded?",[10,403,404],{},"On a current project the delete goes through, and the files stay where they are.",[10,406,407,408,411,412,415,416,418,419,422,423,426,427,429,430,432],{},"Supabase's user-management guide still warns that you cannot delete a user who\nowns objects in Supabase Storage. That was true while ",[21,409,410],{},"storage.objects",", the\ntable where Storage keeps a row for every file, had a foreign key called\n",[21,413,414],{},"objects_owner_fkey"," pointing at ",[21,417,47],{},". Storage has since dropped that key\nin its own schema migrations (",[21,420,421],{},"0017-drop-owner-foreign-key.sql","), and its\nownership guide now says ownership lives in an ",[21,424,425],{},"owner_id"," column. If the query\nearlier in this post lists ",[21,428,410],{}," with ",[21,431,414],{},", your\nproject still has the old rule and the guide's warning applies to you.",[10,434,435,436,439,440,58],{},"Otherwise every file the person uploaded stays in its bucket after they are\ngone. In the club, the coats stay on their hooks with a number tag nobody holds.\nA policy written as ",[21,437,438],{},"owner_id = auth.uid()::text"," will never match them again,\nand a file in a public bucket is still served to anybody who has its link.\nWhether a stranger can list the files in a bucket of yours is one of the checks\nin ",[54,441,443],{"href":442},"\u002Fsecurity-scanner","Reeve's free scan",[10,445,446,447,58],{},"To remove them, go through Storage itself, from the dashboard's Storage page or\nthe Storage API. A plain SQL delete on its tables is refused, and Storage says\nwhy: \"Direct deletion from storage tables is not allowed. Use the Storage API\ninstead.\" What a database copy holds of those files, and what it leaves out, is\nin ",[54,448,450],{"href":449},"\u002Fblog\u002Fsupabase-storage-backup","backing up Supabase Storage",[35,452,454],{"id":453},"take-a-copy-before-you-change-a-foreign-key","Take a copy before you change a foreign key",[10,456,457],{},"Postgres has no recycle bin, and a cascade removes rows from tables you were not\nlooking at.",[10,459,460,461,463,464,468,469,473],{},"Whatever a cascade or a ",[21,462,288],{}," changes is final the moment the delete\nsucceeds, and the only way back is a copy taken before it. Supabase's free plan\nkeeps no backups at all. Pro keeps 7 days of daily copies, Team 14 and Enterprise\nup to 30, and each of them lives inside the same Supabase project.\n",[54,465,467],{"href":466},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Copying your database yourself","\ntakes a few commands, and\n",[54,470,472],{"href":471},"\u002Fblog\u002Fsupabase-backup-auth-users","a copy that includes your users"," needs the\nthird of the three commands Supabase publishes.",[10,475,476],{},"Then try the new rules on a test account before a real one. Create an account,\ngive it one row in each table the query listed, delete it, and look at what is\nleft in each table.",[10,478,479,480,484],{},"If you would rather that copy already existed before anybody pressed delete,\nthat is what ",[54,481,483],{"href":482},"\u002Fsupabase-backups","Supabase backups"," by Reeve are for.",[35,486,488],{"id":487},"keeping-a-way-back-when-a-delete-takes-more-than-you-meant","Keeping a way back when a delete takes more than you meant",[10,490,491,494],{},[83,492,493],{},"A cascade reports nothing about what it removed."," You find out when somebody\nasks where their comments went.",[10,496,497],{},[83,498,499,502],{},[54,500,501],{"href":482},"Reeve Care"," keeps a copy of your Supabase database from\nbefore the delete ran:",[102,504,505,508,511,514,517],{},[79,506,507],{},"an encrypted copy on a schedule, kept on Reeve's own storage in the EU, outside your Supabase account",[79,509,510],{},"each copy verified before it counts, by counting the rows in every table",[79,512,513],{},"a one-click restore that saves what is there now before it replaces anything",[79,515,516],{},"your uploaded files as well, once you connect a Storage credential",[79,518,519,520,524],{},"everything ",[54,521,523],{"href":522},"\u002Fwebsite-monitoring","Reeve Monitor"," does: all nine checks on your live app every hour, and an uptime check every 60 seconds",[35,526,528],{"id":527},"what-to-do-today","What to do today",[530,531,532],"key-takeaways",{},[102,533,534,537,540,549,552],{},[79,535,536],{},"Try the delete once, note the time, and read the Postgres log line at that moment before you change anything.",[79,538,539],{},"If it names a foreign key, run the query above to list every table that points at your users and what each one does on a delete.",[79,541,542,543,545,546,548],{},"Choose per table: ",[21,544,275],{}," for rows that only describe the person, ",[21,547,288],{}," for rows other people still need, the default for anything you want to clear by hand.",[79,550,551],{},"Take a copy of the database before you change any of those rules, and try the new rules on a test account first.",[79,553,554],{},"Remove the person's files through Storage as well. On a current project the account goes and the files stay.",[10,556,557,558,562],{},"If rows have already gone further than you meant,\n",[54,559,561],{"href":560},"\u002Fblog\u002Fai-agent-deleted-my-database","what you can get back after a delete"," goes\nthrough where to look, in order.",{"title":23,"searchDepth":564,"depth":564,"links":565},3,[566,568,569,570,571,572,573,574,575,576],{"id":37,"depth":567,"text":38},2,{"id":67,"depth":567,"text":68},{"id":122,"depth":567,"text":123},{"id":208,"depth":567,"text":209},{"id":236,"depth":567,"text":237},{"id":354,"depth":567,"text":355},{"id":400,"depth":567,"text":401},{"id":453,"depth":567,"text":454},{"id":487,"depth":567,"text":488},{"id":527,"depth":567,"text":528},"Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcover-1200x630.png","A member roll with one line struck through, and behind it two more ledgers whose lines carrying the same number tag have been torn out.","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.",false,"md",[584,586,589,592,595],{"q":38,"a":585},"It means Supabase Auth tried to remove the person's row from auth.users, something in your database refused, and the whole delete was undone. The account is exactly as it was. The message names no table, and the line that does is in your project's Postgres logs at the same moment.",{"q":587,"a":588},"Should I add on delete cascade to fix it?","On a table that only describes the person, like a profiles table, yes, and Supabase's own guide does exactly that. On a table holding things other people still need, like comments or orders, decide first. Cascade deletes every row pointing at the user and every row pointing at those, on every delete from then on, and nothing reports what it removed.",{"q":590,"a":591},"Can I delete a user and keep their rows?","Yes, two ways. Set the foreign key to on delete set null, and the rows stay with an empty owner column, which needs that column to allow empty values. Or call auth.admin.deleteUser() from a server with its shouldSoftDelete option: Supabase Auth keeps the row, marks it deleted, scrambles the email and phone and clears the password, so nothing pointing at it is touched.",{"q":593,"a":594},"Why does Supabase say I cannot delete a user who uploaded files?","Its user-management guide still says so, and it was true while storage.objects had a foreign key called objects_owner_fkey on auth.users. Supabase Storage has since dropped that key in its own schema migrations. On a current project the delete goes through and the files stay in their bucket, under an owner_id no user has any more.",{"q":596,"a":597},"Does deleting a user sign them out?","Not straight away. Supabase's guide says an access token already issued stays valid until it expires, even after the account is deleted. Deleting the user removes their sessions, so the app cannot get a new token, but the one in hand keeps working until its expiry time.","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",[600,601,602,603,604,605,606],"database error deleting user supabase","database error deleting user","failed to delete user database error deleting user","supabase delete user foreign key","supabase on delete cascade auth users","supabase cannot delete user storage","update or delete on table users violates foreign key constraint",{},true,"\"Database error deleting user\" in Supabase","\u002Fblog\u002Fdatabase-error-deleting-user","2026-10-30",{"title":5,"description":580},"blog\u002Fdatabase-error-deleting-user",[615,616,617],"\"Database error deleting user\" in Supabase means the delete reached your database and was refused, so nothing was removed. The line that names the cause is in your Postgres logs, and Supabase's own troubleshooting note sends you there.","When that line says a foreign key is violated, a row in one of your tables still holds the user's id. Postgres will not remove a person while something still points at them, unless you told it what to do with those rows.","The answer you will find first is on delete cascade. It deletes every row that points at the user, and every row that points at those, on every delete from then on. Choose per table, and take a copy before you change one.","eQAXCDyk5s092qPy5k8TSQLuoGeP78xLbKkT71_0dh8",[620,627,633,638,643,649,655,661,667,673,679,680,686,692,698,704,710,716,722,728,734,740,746,752,758,764,770,775,781,787,793,799,805,811,817,823,829,835,841,847,853,859,865,871,877,883,888,894,900,905,911,917,923,929,935,941,947,953,958,964,970,976,982,988,994,1000,1006,1012,1018,1024,1030,1036,1042,1048,1054,1060,1066,1072,1078,1084,1090,1096,1101,1107,1112,1118,1124,1130,1135,1140],{"path":621,"title":622,"description":623,"published":624,"category":625,"image":626,"draft":581},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","Security basics","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":628,"title":629,"description":630,"published":631,"category":625,"image":632,"draft":581},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":164,"title":634,"description":635,"published":636,"category":625,"image":637,"draft":581},"\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":312,"title":639,"description":640,"published":641,"category":625,"image":642,"draft":581},"\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":644,"title":645,"description":646,"published":647,"category":625,"image":648,"draft":581},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":650,"title":651,"description":652,"published":653,"category":625,"image":654,"draft":581},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":656,"title":657,"description":658,"published":659,"category":625,"image":660,"draft":581},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":662,"title":663,"description":664,"published":665,"category":625,"image":666,"draft":581},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":668,"title":669,"description":670,"published":671,"category":625,"image":672,"draft":581},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":674,"title":675,"description":676,"published":677,"category":625,"image":678,"draft":581},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":610,"title":5,"description":580,"published":611,"category":577,"image":598,"draft":581},{"path":681,"title":682,"description":683,"published":684,"category":625,"image":685,"draft":581},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":687,"title":688,"description":689,"published":690,"category":625,"image":691,"draft":581},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":693,"title":694,"description":695,"published":696,"category":625,"image":697,"draft":581},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":699,"title":700,"description":701,"published":702,"category":625,"image":703,"draft":581},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":705,"title":706,"description":707,"published":708,"category":625,"image":709,"draft":581},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":711,"title":712,"description":713,"published":714,"category":625,"image":715,"draft":581},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":717,"title":718,"description":719,"published":720,"category":625,"image":721,"draft":581},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":723,"title":724,"description":725,"published":726,"category":625,"image":727,"draft":581},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":729,"title":730,"description":731,"published":732,"category":625,"image":733,"draft":581},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":735,"title":736,"description":737,"published":738,"category":625,"image":739,"draft":581},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":741,"title":742,"description":743,"published":744,"category":625,"image":745,"draft":581},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":747,"title":748,"description":749,"published":750,"category":625,"image":751,"draft":581},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":753,"title":754,"description":755,"published":756,"category":625,"image":757,"draft":581},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":759,"title":760,"description":761,"published":762,"category":625,"image":763,"draft":581},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":765,"title":766,"description":767,"published":768,"category":625,"image":769,"draft":581},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":56,"title":771,"description":772,"published":773,"category":625,"image":774,"draft":581},"\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":776,"title":777,"description":778,"published":779,"category":625,"image":780,"draft":581},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":782,"title":783,"description":784,"published":785,"category":625,"image":786,"draft":581},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":788,"title":789,"description":790,"published":791,"category":625,"image":792,"draft":581},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":794,"title":795,"description":796,"published":797,"category":625,"image":798,"draft":581},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":800,"title":801,"description":802,"published":803,"category":625,"image":804,"draft":581},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":806,"title":807,"description":808,"published":809,"category":625,"image":810,"draft":581},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":812,"title":813,"description":814,"published":815,"category":625,"image":816,"draft":581},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":818,"title":819,"description":820,"published":821,"category":625,"image":822,"draft":581},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":824,"title":825,"description":826,"published":827,"category":625,"image":828,"draft":581},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":830,"title":831,"description":832,"published":833,"category":625,"image":834,"draft":581},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":836,"title":837,"description":838,"published":839,"category":625,"image":840,"draft":581},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":842,"title":843,"description":844,"published":845,"category":625,"image":846,"draft":581},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":848,"title":849,"description":850,"published":851,"category":625,"image":852,"draft":581},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":854,"title":855,"description":856,"published":857,"category":625,"image":858,"draft":581},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":860,"title":861,"description":862,"published":863,"category":625,"image":864,"draft":581},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":866,"title":867,"description":868,"published":869,"category":577,"image":870,"draft":581},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":872,"title":873,"description":874,"published":875,"category":577,"image":876,"draft":581},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":878,"title":879,"description":880,"published":881,"category":577,"image":882,"draft":581},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":884,"title":885,"description":886,"published":881,"category":625,"image":887,"draft":581},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":889,"title":890,"description":891,"published":892,"category":625,"image":893,"draft":581},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":895,"title":896,"description":897,"published":898,"category":625,"image":899,"draft":581},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":471,"title":901,"description":902,"published":903,"category":577,"image":904,"draft":581},"Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":906,"title":907,"description":908,"published":909,"category":625,"image":910,"draft":581},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":912,"title":913,"description":914,"published":915,"category":625,"image":916,"draft":581},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":918,"title":919,"description":920,"published":921,"category":625,"image":922,"draft":581},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":924,"title":925,"description":926,"published":927,"category":625,"image":928,"draft":581},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":930,"title":931,"description":932,"published":933,"category":625,"image":934,"draft":581},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":936,"title":937,"description":938,"published":939,"category":625,"image":940,"draft":581},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":942,"title":943,"description":944,"published":945,"category":625,"image":946,"draft":581},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":948,"title":949,"description":950,"published":951,"category":625,"image":952,"draft":581},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":449,"title":954,"description":955,"published":956,"category":577,"image":957,"draft":581},"Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":959,"title":960,"description":961,"published":962,"category":577,"image":963,"draft":581},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":965,"title":966,"description":967,"published":968,"category":577,"image":969,"draft":581},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":971,"title":972,"description":973,"published":974,"category":625,"image":975,"draft":581},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":977,"title":978,"description":979,"published":980,"category":625,"image":981,"draft":581},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":983,"title":984,"description":985,"published":986,"category":625,"image":987,"draft":581},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":989,"title":990,"description":991,"published":992,"category":625,"image":993,"draft":581},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":995,"title":996,"description":997,"published":998,"category":625,"image":999,"draft":581},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1001,"title":1002,"description":1003,"published":1004,"category":625,"image":1005,"draft":581},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1007,"title":1008,"description":1009,"published":1010,"category":625,"image":1011,"draft":581},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1013,"title":1014,"description":1015,"published":1016,"category":625,"image":1017,"draft":581},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1019,"title":1020,"description":1021,"published":1022,"category":625,"image":1023,"draft":581},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1025,"title":1026,"description":1027,"published":1028,"category":625,"image":1029,"draft":581},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1031,"title":1032,"description":1033,"published":1034,"category":577,"image":1035,"draft":581},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1037,"title":1038,"description":1039,"published":1040,"category":625,"image":1041,"draft":581},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1043,"title":1044,"description":1045,"published":1046,"category":577,"image":1047,"draft":581},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1049,"title":1050,"description":1051,"published":1052,"category":625,"image":1053,"draft":581},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1055,"title":1056,"description":1057,"published":1058,"category":625,"image":1059,"draft":581},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1061,"title":1062,"description":1063,"published":1064,"category":625,"image":1065,"draft":581},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1067,"title":1068,"description":1069,"published":1070,"category":625,"image":1071,"draft":581},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1073,"title":1074,"description":1075,"published":1076,"category":577,"image":1077,"draft":581},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1079,"title":1080,"description":1081,"published":1082,"category":577,"image":1083,"draft":581},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1085,"title":1086,"description":1087,"published":1088,"category":625,"image":1089,"draft":581},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1091,"title":1092,"description":1093,"published":1094,"category":625,"image":1095,"draft":581},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":560,"title":1097,"description":1098,"published":1099,"category":577,"image":1100,"draft":581},"An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1102,"title":1103,"description":1104,"published":1105,"category":625,"image":1106,"draft":581},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1108,"title":1109,"description":1110,"published":1105,"category":625,"image":1111,"draft":581},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1113,"title":1114,"description":1115,"published":1116,"category":625,"image":1117,"draft":581},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1119,"title":1120,"description":1121,"published":1122,"category":577,"image":1123,"draft":581},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1125,"title":1126,"description":1127,"published":1128,"category":625,"image":1129,"draft":581},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1131,"title":1132,"description":1133,"published":1128,"category":577,"image":1134,"draft":581},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":466,"title":1136,"description":1137,"published":1138,"category":577,"image":1139,"draft":581},"Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1141,"title":1142,"description":1143,"published":1138,"category":625,"image":1144,"draft":581},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]