[{"data":1,"prerenderedAt":1089},["ShallowReactive",2],{"blog-en-database-error-saving-new-user":3,"blog-index-en":563},{"id":4,"title":5,"body":6,"category":520,"cover":521,"coverAlt":522,"description":523,"draft":524,"extension":525,"faq":526,"image":542,"keywords":543,"meta":551,"navigation":552,"ogTitle":553,"path":554,"published":555,"seo":556,"stem":557,"tldr":558,"updated":555,"__hash__":562},"blog_en\u002Fblog\u002Fdatabase-error-saving-new-user.md","\"Database error saving new user\" in Supabase, and where to look",{"type":7,"value":8,"toc":507},"minimark",[9,13,24,27,35,40,43,57,60,63,76,82,86,89,92,95,120,132,138,142,149,159,162,165,169,175,182,196,201,207,211,217,220,226,237,244,257,261,264,273,285,310,316,326,337,348,365,369,372,378,398,401,405,411,420,435,445,462,466,494],[10,11,12],"p",{},"Somebody tries to create an account on your app and gets a reply that is not\nabout them:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","Database error saving new user\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26],{},"Nobody can sign up. The form worked when you built it, your project is up, and\nthe one thing you have to go on is a sentence naming no table, no column and no\nreason.",[10,28,29,30,34],{},"Here is the part that guide after guide gets wrong: ",[31,32,33],"strong",{},"this message was built to\ntell you nothing, and your real error is already written down somewhere else.","\nSearch the string and you are handed a block of SQL to paste, usually somebody's\nversion of a function that writes to a table with their column names in it.\nPasting it either works or adds a second problem to the first. The line that says\nwhat failed is sitting in your own project's logs, and it names the table.",[36,37,39],"h2",{"id":38},"what-database-error-saving-new-user-means","What \"Database error saving new user\" means",[10,41,42],{},"Supabase accepted the new account and then undid it, because something attached\nto the signup failed.",[10,44,45,46,49,50,53,54,56],{},"A signup writes one row, into a table called ",[21,47,48],{},"auth.users"," that Supabase manages\nfor you. Most projects attach something to that write: a trigger that copies the\nnew person into a ",[21,51,52],{},"profiles"," table of your own, a constraint, a foreign key. When\nthe attached thing raises an error, the database rolls the whole operation back,\nand that includes the row in ",[21,55,48],{},". There is no half-made account left\nbehind. There is also nothing in the reply saying which attached thing it was.",[10,58,59],{},"Think of a registration desk with a back office behind it. Somebody signs the\nregister at the desk, and a clerk takes the new name through to copy it into a\nsecond ledger in the back. If the clerk cannot get into the room where that\nledger is kept, the registration does not stand: the line at the desk is struck\nout and the person is told there was a problem. What nobody tells them is that\nthe problem was a locked door forty feet away.",[10,61,62],{},"The vagueness is deliberate, and it is the right call. Your signup form is open\nto the internet. A message that named your tables would be describing your\ndatabase to anybody willing to type an email address into it.",[10,64,65,66,69,70,75],{},"If the reply says ",[21,67,68],{},"email rate limit exceeded"," instead, your database is not the\nproblem: Supabase refused to send the confirmation email, and\n",[71,72,74],"a",{"href":73},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","that error has its own page",".",[77,78],"diagram",{"alt":79,"caption":80,"src":81},"A register panel on the left with its newest row struck through, an arrow leading right to a clerk figure, and the clerk's route into a second panel blocked by an amber bar. A small separate panel to one side holds three lines of recorded text, one of them picked out.","The row in auth.users is written and then taken back out, so nothing survives the failure except a line in a log the reply never mentions.","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fthe-rollback-1600x660.png",[36,83,85],{"id":84},"where-is-the-real-error","Where is the real error?",[10,87,88],{},"In your project's logs, in two steps, and Supabase's own troubleshooting answer\ngives the order.",[10,90,91],{},"Reproduce it once before you go looking, so you have a timestamp to match\nagainst. Try a signup on your live app, let it fail, and note the time.",[10,93,94],{},"Then, in the Supabase dashboard:",[96,97,98,110],"ol",{},[99,100,101,102,105,106,109],"li",{},"Open ",[31,103,104],{},"Logs"," and read the ",[31,107,108],{},"Auth"," logs. Find the entry at that time. It\ncarries the error Auth itself recorded, which is more specific than the\nsentence your app was given.",[99,111,112,113,115,116,119],{},"If that entry points at the database, go back to ",[31,114,104],{}," and open the\n",[31,117,118],{},"Postgres"," logs. The line at the same timestamp is your real error, written\nin the ordinary vocabulary of Postgres: a column, a relation, a type, a\npermission.",[10,121,122,123,125,126,128,129,131],{},"Supabase's troubleshooting note for this message lists three causes. You have a\ntrigger or trigger function on the ",[21,124,48],{}," table that has an error. You have\nadded a constraint on ",[21,127,48],{}," which is not being met. Or you are using\nPrisma and it has broken the permissions on ",[21,130,48],{},". The same note is where\nthe two-step log route above comes from.",[10,133,134,135,137],{},"For an app built in Lovable, Bolt, Replit or v0, the first cause covers most of\nthem, because copying a new signup into a ",[21,136,52],{}," table is the pattern every\nbuilder reaches for and a trigger is how it gets done.",[36,139,141],{"id":140},"cause-1-the-trigger-cannot-reach-your-table","Cause 1: the trigger cannot reach your table",[10,143,144,145,148],{},"The database role that runs your trigger is not allowed outside the ",[21,146,147],{},"auth","\nschema, and your trigger writes outside it.",[10,150,151,152,155,156,158],{},"Supabase explains this on its own discussion board, and the wording is worth\nhaving exactly. The database role managing authentication, ",[21,153,154],{},"supabase_auth_admin",",\nonly has the permissions it needs to perform its duties, so when a trigger\noperated by ",[21,157,154],{}," interacts outside the auth schema, it causes a\npermission error.",[10,160,161],{},"That is the clerk's pass. It opens the front office, because the front office is\nwhere their work is. The second ledger sits in a room the pass was never cut\nfor, and a locked door reports nothing about why it is locked.",[10,163,164],{},"In the Postgres log this arrives as a permission error naming the table your\ntrigger was writing into.",[36,166,168],{"id":167},"the-fix-and-what-it-hands-over","The fix, and what it hands over",[10,170,171,174],{},[21,172,173],{},"security definer"," on the function, which runs it with the privileges of whoever\ncreated it instead of whoever called it.",[10,176,177,178,181],{},"Supabase puts it in one line: a security definer function retains the privileges\nof the database user that created it, and as long as that is the ",[21,179,180],{},"postgres"," role,\nyour auth triggers should be able to engage with outside tables. The clerk stops\ncarrying their own pass and carries the manager's.",[10,183,184,185,188,189,192,193,195],{},"That is a real transfer of authority, so it is worth knowing what you have\nwritten before you paste it. Every statement inside that function now runs as\nthe owner. Supabase's own example pins the search path to nothing, with\n",[21,186,187],{},"security definer set search_path = ''",", and that is why the insert in it names\n",[21,190,191],{},"public.profiles"," in full rather than ",[21,194,52],{},". With an empty search path a\nbare table name resolves to nothing at all. A function carrying the owner's\nprivileges cannot then have its target quietly swapped for a different table by\nwhatever the caller's search path happens to say.",[77,197],{"alt":198,"caption":199,"src":200},"The same route drawn twice. In the upper lane a figure carrying a small pass is stopped by a barred door in front of a ledger panel. In the lower lane the same figure carries a larger pass and the door stands open, with the route continuing into the panel.","Which pass the function carries is the whole difference. security definer is the lower lane, and it is the owner's pass rather than a wider version of the caller's.","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Ftwo-passes-1600x620.png",[10,202,203,204,206],{},"What this does not license is reaching for ",[21,205,173],{}," the next time\nsomething is denied. Keep the function doing one thing and returning, which is\nwhat Supabase's version does.",[36,208,210],{"id":209},"cause-2-a-rule-on-the-table-you-are-writing-into","Cause 2: a rule on the table you are writing into",[10,212,213,214,216],{},"Row level security on your ",[21,215,52],{}," table can refuse the insert, and the\nsignup then fails in exactly the same way.",[10,218,219],{},"Supabase's guide to this pattern tells you to turn row level security on for\nthat table, and that is the right instruction. What it means for your trigger is\nthat the insert has to be permitted, either by a policy that covers it or by a\nfunction running as somebody the policies do not apply to.",[10,221,222,223,225],{},"Here is where this stops being a bug and becomes a decision somebody makes at\neleven at night. Nobody can register, the error says nothing, and there is a\nswitch in the dashboard, labelled in plain language, that makes the error go\naway: turn row level security off on ",[21,224,52],{},". Registration works on the next\nattempt. What also happens is that a table holding your users, with whatever you\nkeep in it beside their names, starts answering anybody who asks for it.",[10,227,228,229,232,233,236],{},"That part is visible from outside, which is how we can count it. Our scanner\nreads live apps the way a stranger would. We found a Supabase project behind\n8,435 of the apps it has graded. On 3,680 of those the question \"can somebody\nwith no account read this table\" got a usable answer at all, and ",[31,230,231],{},"2,096\nanswered yes",". In ",[31,234,235],{},"394"," of them the open table was named like a table of\npeople.",[10,238,239,240,75],{},"Some of that is deliberate, because a published menu and a page of listings live\nin tables a stranger is meant to read, and our scanner cannot tell those from a\ntable of customers that was opened to clear an error. It reports what answered.\nIf you would rather see your own answer than reason about it, our free scan reads\nyour live app and tells you which tables replied. It takes about 20 seconds and\nneeds no account: ",[71,241,243],{"href":242},"\u002Fsecurity-scanner","scan your app",[10,245,246,247,251,252,256],{},"The policy a trigger needs is a good deal narrower than switching the rules off.\n",[71,248,250],{"href":249},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Turning row level security on for every table","\ncovers writing one, and\n",[71,253,255],{"href":254},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","\"new row violates row-level security policy\"","\nis the message you get when a policy refuses an insert you can see with your own\neyes.",[36,258,260],{"id":259},"the-other-causes-and-how-each-one-reads-in-the-log","The other causes, and how each one reads in the log",[10,262,263],{},"Four more, and the log line distinguishes them in a few words.",[10,265,266,269,270,272],{},[31,267,268],{},"A table that is not there."," Supabase's note covers this: a trigger function\nreferencing a table that does not exist or was deleted. A ",[21,271,52],{}," table\ndropped and rebuilt under a different name takes every signup with it, and the\nlog names the missing relation.",[10,274,275,280,281,75],{},[31,276,277,278,75],{},"A constraint on ",[21,279,48],{}," A check or a foreign key added to that table\nwhich the new row does not satisfy. Worth looking for even when you are sure you\nadded no trigger, because a foreign key between your own table and the auth user\nis the commonest way this one arrives. Left at its default, the same foreign key\nis what refuses the delete when that person is removed later, and\n",[71,282,284],{"href":283},"\u002Fblog\u002Fdatabase-error-deleting-user","that message has a post of its own",[10,286,287,290,291,294,295,298,299,301,302,305,306,309],{},[31,288,289],{},"A value that is not the right type."," This one appears word for word. A trigger\ncopying signup fields out of ",[21,292,293],{},"raw_user_meta_data"," reads them with ",[21,296,297],{},"->>",", and\n",[21,300,297],{}," hands back text whatever the value looked like going in. Writing that text\ninto a ",[21,303,304],{},"date"," column produced, in one reported case,\n",[21,307,308],{},"column \"birth_date\" is of type date but expression is of type text",". The repair\nis a cast, with the extraction bracketed first:",[14,311,314],{"className":312,"code":313,"language":19},[17],"(new.raw_user_meta_data->>'birthDate')::date,\n(new.raw_user_meta_data->>'height')::integer,\n",[21,315,313],{"__ignoreMap":23},[10,317,318,321,322,325],{},[31,319,320],{},"Rows inserted by hand."," Supabase's note also covers accounts created directly\nwith SQL rather than through the Auth API, where required columns in the auth\nschema are left as NULL instead of empty strings. If somebody seeded users with\nan ",[21,323,324],{},"insert"," statement, that is a different repair from any of the above.",[10,327,328,329,332,333,75],{},"One more line you may meet there: ",[21,330,331],{},"duplicate key value violates unique constraint",".\nIt means the row your trigger writes was already there, for example because your\napp inserts the same profile after sign-up, and\n",[71,334,336],{"href":335},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","that error has a post of its own",[10,338,339,340,343,344,75],{},"And one more: ",[21,341,342],{},"null value in column … violates not-null constraint",". Your trigger\nwrote an empty value into a column that requires one, usually a sign-up field the\nform never sent, and\n",[71,345,347],{"href":346},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","that one has a post of its own too",[10,349,350,351,354,355,358,359,298,362,75],{},"The last one you may meet is\n",[21,352,353],{},"insert or update on table \"profiles\" violates foreign key constraint",". It\nusually means the trigger was created ",[21,356,357],{},"before insert",", so the person it writes a\nprofile for is not saved yet. Supabase's pattern below uses ",[21,360,361],{},"after insert",[71,363,284],{"href":364},"\u002Fblog\u002Fviolates-foreign-key-constraint",[36,366,368],{"id":367},"the-working-version-in-full","The working version, in full",[10,370,371],{},"Start from Supabase's published pattern rather than from a search result, because\nfour things in it are load-bearing and a paraphrase tends to drop one.",[14,373,376],{"className":374,"code":375,"language":19},[17],"create function public.handle_new_user()\nreturns trigger\nlanguage plpgsql\nsecurity definer set search_path = ''\nas $$\nbegin\n  insert into public.profiles (id, first_name, last_name)\n  values (new.id, new.raw_user_meta_data ->> 'first_name', new.raw_user_meta_data ->> 'last_name');\n  return new;\nend;\n$$;\n\ncreate trigger on_auth_user_created\n  after insert on auth.users\n  for each row execute procedure public.handle_new_user();\n",[21,377,375],{"__ignoreMap":23},[10,379,380,381,383,384,387,388,390,391,394,395,397],{},"The four are ",[21,382,173],{},", the empty ",[21,385,386],{},"search_path",", the fully qualified\n",[21,389,191],{},", and the ",[21,392,393],{},"return new"," that lets the signup carry on. Your own\ncolumn names go into the insert, and every column you name there has to exist and\nhas to accept what ",[21,396,297],{}," gives it.",[10,399,400],{},"Supabase's guide adds the sentence worth repeating: if the trigger fails, it\ncould block signups, so test your code thoroughly. Create one real account on\nyour live app after any change to it.",[36,402,404],{"id":403},"keeping-your-signup-working-after-you-change-it","Keeping your signup working after you change it",[10,406,407,410],{},[31,408,409],{},"A signup is the part of your app you stop testing on the day it works."," You\nregistered once, you have an account, and after that you sign in. The next prompt\nthat touches your tables can break registration for everybody while your own\nsession goes on behaving normally.",[10,412,413],{},[31,414,415,419],{},[71,416,418],{"href":417},"\u002Fwebsite-monitoring","Reeve Monitor"," looks for you:",[421,422,423,426,429,432],"ul",{},[99,424,425],{},"all nine checks every hour, on up to three apps",[99,427,428],{},"an email the day a re-scan grades your app lower than the one before",[99,430,431],{},"whether the app is up, every 60 seconds",[99,433,434],{},"a monthly report of what it saw",[10,436,437],{},[31,438,439,440,444],{},"A rule switched off to clear an error leaves a table of people readable.\n",[71,441,443],{"href":442},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database where no\nchange to your rules can reach it.",[421,446,447,450,453,456,459],{},[99,448,449],{},"an encrypted copy every day, kept outside your Supabase account",[99,451,452],{},"each copy verified before it counts, by counting the rows in every table",[99,454,455],{},"a one-click restore that saves what is there now before it replaces anything",[99,457,458],{},"your uploaded files as well, once you connect a Storage credential",[99,460,461],{},"everything Monitor does",[36,463,465],{"id":464},"what-to-do-today","What to do today",[467,468,469],"key-takeaways",{},[421,470,471,474,477,488,491],{},[99,472,473],{},"Reproduce one failed signup and note the time before you change anything.",[99,475,476],{},"Read the Auth log entry at that timestamp, then the Postgres log line at the same time if the Auth entry points at the database. That line names the column, relation or permission that failed.",[99,478,479,480,482,483,485,486,75],{},"Check your trigger function carries ",[21,481,173],{}," and names its target in full, as ",[21,484,191],{}," rather than ",[21,487,52],{},[99,489,490],{},"If a policy on that table is refusing the insert, write a policy for it. Switching row level security off clears the error and leaves that table readable by anybody who asks.",[99,492,493],{},"Create one real account on your live app after any change to a signup trigger. Your own session hides a broken registration from you completely.",[10,495,496,497,501,502,506],{},"Start with the table your trigger writes into, then read the policies on every\ntable you touched the same week. The\n",[71,498,500],{"href":499},"\u002Fchecklist","10-minute security checklist"," covers what else tends to be left open\nin a newly launched app, and the\n",[71,503,505],{"href":504},"\u002Fis-your-supabase-app-safe","Supabase safety guide"," goes through the rest of what\na stranger can reach.",{"title":23,"searchDepth":508,"depth":508,"links":509},3,[510,512,513,514,515,516,517,518,519],{"id":38,"depth":511,"text":39},2,{"id":84,"depth":511,"text":85},{"id":140,"depth":511,"text":141},{"id":167,"depth":511,"text":168},{"id":209,"depth":511,"text":210},{"id":259,"depth":511,"text":260},{"id":367,"depth":511,"text":368},{"id":403,"depth":511,"text":404},{"id":464,"depth":511,"text":465},"Security basics","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcover-1200x630.png","A signed register at a front desk with the newest line already struck through, and behind it a second ledger standing closed in a room with a barred door.","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.",false,"md",[527,530,533,536,539],{"q":528,"a":529},"What does \"Database error saving new user\" mean?","It means Supabase wrote the new person into its own auth.users table, something attached to that write failed, and the database undid the whole operation including the new row. So no account was created and there is nothing half-made to clean up. The message names no table and no reason on purpose, because a signup form is open to the internet and a specific error would describe your database to anybody who tried an email address.",{"q":531,"a":532},"Where do I find the real error?","In your project's logs, and Supabase's own troubleshooting answer gives the order. Try one signup, let it fail, and note the time. Open Logs and read the Auth entry at that timestamp, which carries what Auth itself recorded. If that entry points at the database, open the Postgres logs at the same time: that line names the column, the relation or the permission that actually failed.",{"q":534,"a":535},"Does row level security on my profiles table break signup?","It can. If your trigger inserts into a table with row level security on and no policy allows that insert, the insert is refused and the signup fails with the same vague message. The fix is a policy for it, or a function that runs with privileges the policies do not apply to. Turning the rules off on that table also clears the error, and it leaves a table of your users readable by anybody who asks for it.",{"q":537,"a":538},"What is security definer and is it safe?","It makes the function run with the privileges of whoever created it instead of whoever called it, which is what lets a trigger run by the auth role write to a table of your own. It is the pattern Supabase publishes, and it is a real transfer of authority, so the function should do one narrow thing. Supabase also pins the search path to nothing in its example, which is why the insert names public.profiles in full rather than profiles.",{"q":540,"a":541},"I never created a trigger. What else could it be?","Three other things. A constraint or a foreign key added to auth.users that the new row does not satisfy. A trigger function that references a table that was renamed or deleted. And Supabase's note names Prisma specifically, because it can break the permissions on auth.users. The Postgres log line tells you which of them you have.","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",[544,545,546,547,548,549,550],"database error saving new user","supabase database error saving new user","supabase signup error","auth.users trigger error","handle_new_user not working","supabase security definer trigger","supabase signup 500 error",{},true,"\"Database error saving new user\" in Supabase","\u002Fblog\u002Fdatabase-error-saving-new-user","2026-10-14",{"title":5,"description":523},"blog\u002Fdatabase-error-saving-new-user",[559,560,561],"\"Database error saving new user\" means Supabase accepted the signup, something attached to it failed, and the whole thing was undone. No account was created.","The message is deliberately vague, and the real one is already recorded. Supabase's own troubleshooting answer sends you to the Auth logs first, then to the Postgres logs for the line underneath.","Nearly always it is a trigger on auth.users that cannot reach the table it writes into. The fix is a security definer function, and the part to get right is how much that function is allowed to do.","k21JXwXbvURzP-bWE0e2gZlWYtP0-ooNu_X_L12A_ZI",[564,570,576,581,586,592,598,604,610,616,622,628,634,640,646,652,658,663,669,675,681,686,692,698,704,710,716,717,723,729,735,741,747,753,759,765,771,777,783,789,795,801,807,813,819,825,830,836,842,848,854,860,866,872,878,884,890,896,902,908,914,920,925,931,937,943,949,955,961,967,973,979,985,991,997,1003,1008,1014,1020,1026,1032,1038,1044,1050,1055,1061,1067,1073,1078,1084],{"path":565,"title":566,"description":567,"published":568,"category":520,"image":569,"draft":524},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":571,"title":572,"description":573,"published":574,"category":520,"image":575,"draft":524},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":364,"title":577,"description":578,"published":579,"category":520,"image":580,"draft":524},"\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":346,"title":582,"description":583,"published":584,"category":520,"image":585,"draft":524},"\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":587,"title":588,"description":589,"published":590,"category":520,"image":591,"draft":524},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":593,"title":594,"description":595,"published":596,"category":520,"image":597,"draft":524},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":599,"title":600,"description":601,"published":602,"category":520,"image":603,"draft":524},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":605,"title":606,"description":607,"published":608,"category":520,"image":609,"draft":524},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":611,"title":612,"description":613,"published":614,"category":520,"image":615,"draft":524},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":617,"title":618,"description":619,"published":620,"category":520,"image":621,"draft":524},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":283,"title":623,"description":624,"published":625,"category":626,"image":627,"draft":524},"\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":629,"title":630,"description":631,"published":632,"category":520,"image":633,"draft":524},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":635,"title":636,"description":637,"published":638,"category":520,"image":639,"draft":524},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":641,"title":642,"description":643,"published":644,"category":520,"image":645,"draft":524},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":647,"title":648,"description":649,"published":650,"category":520,"image":651,"draft":524},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":653,"title":654,"description":655,"published":656,"category":520,"image":657,"draft":524},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":335,"title":659,"description":660,"published":661,"category":520,"image":662,"draft":524},"Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":664,"title":665,"description":666,"published":667,"category":520,"image":668,"draft":524},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":670,"title":671,"description":672,"published":673,"category":520,"image":674,"draft":524},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":676,"title":677,"description":678,"published":679,"category":520,"image":680,"draft":524},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":73,"title":682,"description":683,"published":684,"category":520,"image":685,"draft":524},"Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":687,"title":688,"description":689,"published":690,"category":520,"image":691,"draft":524},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":693,"title":694,"description":695,"published":696,"category":520,"image":697,"draft":524},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":699,"title":700,"description":701,"published":702,"category":520,"image":703,"draft":524},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":705,"title":706,"description":707,"published":708,"category":520,"image":709,"draft":524},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":711,"title":712,"description":713,"published":714,"category":520,"image":715,"draft":524},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":554,"title":5,"description":523,"published":555,"category":520,"image":542,"draft":524},{"path":718,"title":719,"description":720,"published":721,"category":520,"image":722,"draft":524},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":724,"title":725,"description":726,"published":727,"category":520,"image":728,"draft":524},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":730,"title":731,"description":732,"published":733,"category":520,"image":734,"draft":524},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":736,"title":737,"description":738,"published":739,"category":520,"image":740,"draft":524},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":742,"title":743,"description":744,"published":745,"category":520,"image":746,"draft":524},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":748,"title":749,"description":750,"published":751,"category":520,"image":752,"draft":524},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":754,"title":755,"description":756,"published":757,"category":520,"image":758,"draft":524},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":760,"title":761,"description":762,"published":763,"category":520,"image":764,"draft":524},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":766,"title":767,"description":768,"published":769,"category":520,"image":770,"draft":524},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":772,"title":773,"description":774,"published":775,"category":520,"image":776,"draft":524},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":778,"title":779,"description":780,"published":781,"category":520,"image":782,"draft":524},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":784,"title":785,"description":786,"published":787,"category":520,"image":788,"draft":524},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":790,"title":791,"description":792,"published":793,"category":520,"image":794,"draft":524},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":796,"title":797,"description":798,"published":799,"category":520,"image":800,"draft":524},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":802,"title":803,"description":804,"published":805,"category":520,"image":806,"draft":524},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":808,"title":809,"description":810,"published":811,"category":626,"image":812,"draft":524},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":814,"title":815,"description":816,"published":817,"category":626,"image":818,"draft":524},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":820,"title":821,"description":822,"published":823,"category":626,"image":824,"draft":524},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":826,"title":827,"description":828,"published":823,"category":520,"image":829,"draft":524},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":831,"title":832,"description":833,"published":834,"category":520,"image":835,"draft":524},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":837,"title":838,"description":839,"published":840,"category":520,"image":841,"draft":524},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":843,"title":844,"description":845,"published":846,"category":626,"image":847,"draft":524},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":849,"title":850,"description":851,"published":852,"category":520,"image":853,"draft":524},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":855,"title":856,"description":857,"published":858,"category":520,"image":859,"draft":524},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":861,"title":862,"description":863,"published":864,"category":520,"image":865,"draft":524},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":867,"title":868,"description":869,"published":870,"category":520,"image":871,"draft":524},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":873,"title":874,"description":875,"published":876,"category":520,"image":877,"draft":524},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":879,"title":880,"description":881,"published":882,"category":520,"image":883,"draft":524},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":885,"title":886,"description":887,"published":888,"category":520,"image":889,"draft":524},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":891,"title":892,"description":893,"published":894,"category":520,"image":895,"draft":524},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":897,"title":898,"description":899,"published":900,"category":626,"image":901,"draft":524},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":903,"title":904,"description":905,"published":906,"category":626,"image":907,"draft":524},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":909,"title":910,"description":911,"published":912,"category":626,"image":913,"draft":524},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":915,"title":916,"description":917,"published":918,"category":520,"image":919,"draft":524},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":249,"title":921,"description":922,"published":923,"category":520,"image":924,"draft":524},"Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":926,"title":927,"description":928,"published":929,"category":520,"image":930,"draft":524},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":932,"title":933,"description":934,"published":935,"category":520,"image":936,"draft":524},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":938,"title":939,"description":940,"published":941,"category":520,"image":942,"draft":524},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":944,"title":945,"description":946,"published":947,"category":520,"image":948,"draft":524},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":950,"title":951,"description":952,"published":953,"category":520,"image":954,"draft":524},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":956,"title":957,"description":958,"published":959,"category":520,"image":960,"draft":524},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":962,"title":963,"description":964,"published":965,"category":520,"image":966,"draft":524},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":968,"title":969,"description":970,"published":971,"category":520,"image":972,"draft":524},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":974,"title":975,"description":976,"published":977,"category":626,"image":978,"draft":524},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":980,"title":981,"description":982,"published":983,"category":520,"image":984,"draft":524},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":986,"title":987,"description":988,"published":989,"category":626,"image":990,"draft":524},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":992,"title":993,"description":994,"published":995,"category":520,"image":996,"draft":524},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":998,"title":999,"description":1000,"published":1001,"category":520,"image":1002,"draft":524},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":254,"title":1004,"description":1005,"published":1006,"category":520,"image":1007,"draft":524},"New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1009,"title":1010,"description":1011,"published":1012,"category":520,"image":1013,"draft":524},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1015,"title":1016,"description":1017,"published":1018,"category":626,"image":1019,"draft":524},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1021,"title":1022,"description":1023,"published":1024,"category":626,"image":1025,"draft":524},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1027,"title":1028,"description":1029,"published":1030,"category":520,"image":1031,"draft":524},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1033,"title":1034,"description":1035,"published":1036,"category":520,"image":1037,"draft":524},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1039,"title":1040,"description":1041,"published":1042,"category":626,"image":1043,"draft":524},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1045,"title":1046,"description":1047,"published":1048,"category":520,"image":1049,"draft":524},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1051,"title":1052,"description":1053,"published":1048,"category":520,"image":1054,"draft":524},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1056,"title":1057,"description":1058,"published":1059,"category":520,"image":1060,"draft":524},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1062,"title":1063,"description":1064,"published":1065,"category":626,"image":1066,"draft":524},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1068,"title":1069,"description":1070,"published":1071,"category":520,"image":1072,"draft":524},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1074,"title":1075,"description":1076,"published":1071,"category":626,"image":1077,"draft":524},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1079,"title":1080,"description":1081,"published":1082,"category":626,"image":1083,"draft":524},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1085,"title":1086,"description":1087,"published":1082,"category":520,"image":1088,"draft":524},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]