[{"data":1,"prerenderedAt":1371},["ShallowReactive",2],{"blog-en-duplicate-key-value-violates-unique-constraint":3,"blog-index-en":843},{"id":4,"title":5,"body":6,"category":801,"cover":802,"coverAlt":803,"description":804,"draft":805,"extension":806,"faq":807,"image":822,"keywords":823,"meta":832,"navigation":833,"ogTitle":5,"path":834,"published":835,"seo":836,"stem":837,"tldr":838,"updated":835,"__hash__":842},"blog_en\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint.md","Supabase \"duplicate key value violates unique constraint\", explained",{"type":7,"value":8,"toc":789},"minimark",[9,13,24,31,34,39,42,45,48,167,180,184,193,267,270,278,292,296,299,302,324,337,343,367,380,386,390,393,400,408,414,420,433,444,448,451,478,515,521,541,557,560,565,569,572,593,608,616,632,635,641,663,668,672,675,684,707,716,734,738,779],[10,11,12],"p",{},"Someone fills in your waitlist form, waits, and presses the button again. The\nfirst press had gone through. The second one comes back as an error, and the\nbrowser console has all of it:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","{\n  \"code\": \"23505\",\n  \"details\": \"Key (email)=(maria@example.com) already exists.\",\n  \"hint\": null,\n  \"message\": \"duplicate key value violates unique constraint \\\"waitlist_email_key\\\"\"\n}\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26,27,30],{},"Supabase \"duplicate key value violates unique constraint\" means Postgres refused\nto add the row because another row already holds the same value in a column that\nallows each value once. Here the column is ",[21,28,29],{},"email",", and Maria is already on your\nlist.",[10,32,33],{},"The advice passed around for this error is to switch the insert to an upsert.\nSometimes that is right. On a table your visitors may only add to, though, an\nupsert from the browser needs rules that let them read the table, and the line\nwith Maria's address in it is something your app should never print to a visitor\nat all.",[35,36,38],"h2",{"id":37},"what-does-duplicate-key-value-violates-unique-constraint-mean","What does \"duplicate key value violates unique constraint\" mean?",[10,40,41],{},"It means the value you tried to save is already in a column that takes each\nvalue once, so Postgres refused the whole row. Nothing was written, and the row\nthat was there first is unchanged.",[10,43,44],{},"Think of the table as the guest list at a door, one line per name. A unique\nconstraint is the doorman's rule that a name goes on the list once. Your app\nwalked up with a name already written there, and he turned it away.",[10,46,47],{},"Each part of the error says one thing:",[49,50,51,67],"table",{},[52,53,54],"thead",{},[55,56,57,61,64],"tr",{},[58,59,60],"th",{},"Field",[58,62,63],{},"Example",[58,65,66],{},"What it tells you",[68,69,70,96,111,126,141],"tbody",{},[55,71,72,77,82],{},[73,74,75],"td",{},[21,76,21],{},[73,78,79],{},[21,80,81],{},"23505",[73,83,84,85,88,89],{},"Postgres's code for this error, named ",[21,86,87],{},"unique_violation"," in ",[90,91,95],"a",{"href":92,"rel":93},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Futils\u002Ferrcodes.txt",[94],"nofollow","its list of codes",[55,97,98,103,108],{},[73,99,100],{},[21,101,102],{},"message",[73,104,105],{},[21,106,107],{},"duplicate key value violates unique constraint \"waitlist_email_key\"",[73,109,110],{},"Which rule refused the row, by name",[55,112,113,118,123],{},[73,114,115],{},[21,116,117],{},"details",[73,119,120],{},[21,121,122],{},"Key (email)=(maria@example.com) already exists.",[73,124,125],{},"The column and the value that clashed, when Postgres decides the caller may see them",[55,127,128,133,138],{},[73,129,130],{},[21,131,132],{},"hint",[73,134,135],{},[21,136,137],{},"null",[73,139,140],{},"Nothing to add for this error",[55,142,143,146,151],{},[73,144,145],{},"HTTP status",[73,147,148],{},[21,149,150],{},"409 Conflict",[73,152,153,154,157,158,160,161,166],{},"How PostgREST, the part of Supabase that turns ",[21,155,156],{},"supabase.from(...)"," calls into SQL, reports ",[21,159,81],{}," (",[90,162,165],{"href":163,"rel":164},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fblob\u002Fmain\u002Fsrc\u002Flibrary\u002FPostgREST\u002FError.hs",[94],"its code",")",[10,168,169,170,175,176,179],{},"The wording is Postgres's own.\n",[90,171,174],{"href":172,"rel":173},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Faccess\u002Fnbtree\u002Fnbtinsert.c",[94],"The code that raises it","\nadds the ",[21,177,178],{},"Key ... already exists"," line only when it has a description of the key\nto give, and a section further down covers when it has none.",[35,181,183],{"id":182},"which-column-caused-it","Which column caused it?",[10,185,186,187,192],{},"The name in quotes tells you, because Postgres builds it from the table and the\ncolumns unless somebody chose a different one.\n",[90,188,191],{"href":189,"rel":190},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Fcommands\u002Findexcmds.c",[94],"Its naming code","\ngives three shapes:",[49,194,195,207],{},[52,196,197],{},[55,198,199,202,205],{},[58,200,201],{},"The name ends in",[58,203,204],{},"It is",[58,206,63],{},[68,208,209,233,251],{},[55,210,211,216,221],{},[73,212,213],{},[21,214,215],{},"_key",[73,217,218,219],{},"a unique constraint on the columns between the table name and ",[21,220,215],{},[73,222,223,226,227,230,231],{},[21,224,225],{},"waitlist_email_key",": table ",[21,228,229],{},"waitlist",", column ",[21,232,29],{},[55,234,235,240,246],{},[73,236,237],{},[21,238,239],{},"_pkey",[73,241,242,243],{},"the table's primary key, usually ",[21,244,245],{},"id",[73,247,248],{},[21,249,250],{},"orders_pkey",[55,252,253,259,262],{},[73,254,255,258],{},[21,256,257],{},"_idx",", or anything else",[73,260,261],{},"a unique index made by hand, or a constraint somebody named",[73,263,264],{},[21,265,266],{},"profiles_username_idx",[10,268,269],{},"The message says \"unique constraint\" for all three. To see exactly what a name\ncovers, run this in the SQL Editor with the name from your message:",[14,271,276],{"className":272,"code":274,"language":275,"meta":23},[273],"language-sql","select tablename, indexdef\nfrom pg_indexes\nwhere indexname = 'waitlist_email_key';\n","sql",[21,277,274],{"__ignoreMap":23},[10,279,280,283,284,287,288,291],{},[21,281,282],{},"indexdef"," comes back as something like\n",[21,285,286],{},"CREATE UNIQUE INDEX waitlist_email_key ON public.waitlist USING btree (email)",",\nand the columns in the brackets are the ones that may not repeat. A rule on two\ncolumns, such as ",[21,289,290],{},"(team_id, email)",", lets the same address join two teams and\nrefuses it twice in one.",[35,293,295],{"id":294},"key-id1-already-exists-when-you-never-sent-an-id","\"Key (id)=(1) already exists\" when you never sent an id",[10,297,298],{},"This one means the table's id counter is behind the rows already in it, so it\nhanded out a number that is taken. Your app sent no id. Postgres took the next\nnumber from the counter, and a row with that number was already there.",[10,300,301],{},"On the guest list, the doorman also hands out numbered wristbands from a roll.\nSomeone copied the first two hundred guests in by hand, wristband numbers\nincluded, and nobody wound the roll on. It still starts at 1.",[10,303,304,305,310,311,316,317,319,320,323],{},"A column that numbers itself takes each number from a sequence, Postgres's word\nfor that counter. Postgres's\n",[90,306,309],{"href":307,"rel":308},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fddl-identity-columns.html",[94],"page on identity columns","\nsays such a column \"does not guarantee uniqueness\", and gives this case as one of\nthe reasons: values \"could be inserted manually into the identity column\". Rows\narrive with their numbers already filled in from a CSV import that includes the\nid column, a copy from another project, or a seed script. The counter never\nhears about any of them.\n",[90,312,315],{"href":313,"rel":314},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fwhy-are-there-gaps-in-my-postgres-id-sequence-Frifus",[94],"Supabase's troubleshooting page on id sequences","\ncovers this exact message on a ",[21,318,239],{},", and its repair is a ",[21,321,322],{},"setval"," as well.",[10,325,326,327,330,331,333,334,336],{},"The repair is one statement. Put your own table and column in place of ",[21,328,329],{},"orders","\nand ",[21,332,245],{},"; the table is the part of the name before ",[21,335,239],{},":",[14,338,341],{"className":339,"code":340,"language":275,"meta":23},[273],"select setval(\n  pg_get_serial_sequence('public.orders', 'id'),\n  (select max(id) from public.orders)\n);\n",[21,342,340],{"__ignoreMap":23},[10,344,345,348,349,354,355,361,362,366],{},[21,346,347],{},"pg_get_serial_sequence"," finds the counter behind the column, and\n",[90,350,353],{"href":351,"rel":352},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Ffunctions-info.html",[94],"Postgres's documentation","\nsays it works for both kinds: \"If the column is an identity column, the\nassociated sequence is the sequence internally created for that column.\" Then\n",[90,356,359],{"href":357,"rel":358},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Ffunctions-sequence.html",[94],[21,360,322],{}," with\ntwo arguments sets the counter so that \"the next nextval will advance the\nsequence before returning a value\". The next new row gets the highest id plus\none. If Postgres answers that the relation does not exist, the table is spelled\ndifferently, has a capital letter or sits in another schema, and\n",[90,363,365],{"href":364},"\u002Fblog\u002Fsupabase-relation-does-not-exist","that error has a post of its own",".",[10,368,369,370,373,374,379],{},"A restore from ",[21,371,372],{},"pg_dump"," output does not leave you here.\n",[90,375,378],{"href":376,"rel":377},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fapp-pgdump.html",[94],"Its documentation","\nlists what a data dump carries: \"Table data, large objects, and sequence values\nare dumped.\" Each counter comes back with its rows.",[381,382],"diagram",{"alt":383,"caption":384,"src":385},"A list of five numbered rows, 1 to 5, beside a counter. On the left the counter reads 1 and points at row 1, which is lit amber, ending at a plate reading Key (id)=(1). On the right the counter reads 6 and points at a new name on the sixth line, with a tick below.","Rows copied in with their own ids leave the counter where it was. setval moves it past the highest id, and the next row gets a free number.","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fthe-counter-is-behind-1600x640.png",[35,387,389],{"id":388},"the-three-ways-to-handle-a-duplicate","The three ways to handle a duplicate",[10,391,392],{},"Decide what should happen when the value is already there: refuse the new row\nand say so, let it replace the old row, or stop sending it in the first place.",[10,394,395,399],{},[396,397,398],"strong",{},"Refuse it, in your own words."," This fits when a second row would be a mistake:\nan address already registered, a username already taken. The insert fails, your\napp reads the code, and the person sees a sentence you wrote:",[14,401,406],{"className":402,"code":404,"language":405,"meta":23},[403],"language-js","const { error } = await supabase.from('profiles').insert({ id: user.id, username })\n\nif (error?.code === '23505') {\n  setMessage('That username is taken. Try another one.')\n} else if (error) {\n  setMessage('Something went wrong. Please try again.')\n}\n","js",[21,407,404],{"__ignoreMap":23},[10,409,410,413],{},[396,411,412],{},"Let it replace the old row."," This fits when the newest version should win: a\nsettings row per user, one cart per session. That is an upsert, and the next\nsection is about when it goes wrong.",[10,415,416,419],{},[396,417,418],{},"Stop sending it."," Sometimes the second row was never meant to exist, and it\narrives from one of these:",[421,422,423,427,430],"ul",{},[424,425,426],"li",{},"a button that sends the form again when pressed again. Disable it until the\nfirst request answers.",[424,428,429],{},"a retry after a slow response, when the first attempt had gone through",[424,431,432],{},"two writers for one row, such as a trigger that creates each new user's\nprofile and app code that inserts the same profile after sign-up",[10,434,435,436,440,441,443],{},"The trigger case is worth knowing by sight. A trigger that copies new users into\na table of yours fails with this error when the value it copies is already\nthere, and Supabase reports the whole sign-up as\n",[90,437,439],{"href":438},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\"",". The\n",[21,442,81],{}," itself is in the Postgres logs, and that post shows where.",[35,445,447],{"id":446},"should-you-use-upsert","Should you use upsert?",[10,449,450],{},"Use it when the new row should replace the old one, and check three things\nbefore you rely on it.",[10,452,453,456,457,462,463,466,467,470,471,474,475,366],{},[21,454,455],{},".upsert()"," in supabase-js is an insert that does something else when the row\nexists. ",[90,458,461],{"href":459,"rel":460},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase-js\u002Fblob\u002Fmaster\u002Fpackages\u002Fcore\u002Fpostgrest-js\u002Fsrc\u002FPostgrestQueryBuilder.ts",[94],"Its source","\nputs it in two lines: \"If ",[21,464,465],{},"true",", duplicate rows are ignored. If ",[21,468,469],{},"false",",\nduplicate rows are merged with existing rows.\" That is the ",[21,472,473],{},"ignoreDuplicates","\noption, and Postgres runs either version as ",[21,476,477],{},"insert ... on conflict",[10,479,480,487,492,493,496,497,499,500,502,503,505,506,508,509,514],{},[396,481,482,483,486],{},"1. ",[21,484,485],{},"onConflict"," has to name the column from your error.",[90,488,491],{"href":489,"rel":490},"https:\u002F\u002Fdocs.postgrest.org\u002Fen\u002Fstable\u002Freferences\u002Fapi\u002Ftables_views.html",[94],"PostgREST's documentation","\nsays: \"By default, upsert operates based on the primary key columns\". An upsert\nof ",[21,494,495],{},"{ email }"," into a table whose primary key is ",[21,498,245],{}," looks for a clash on ",[21,501,245],{},",\nfinds none because the id is new, inserts, and meets the rule on ",[21,504,29],{}," with the\nsame ",[21,507,81],{},". Postgres's\n",[90,510,513],{"href":511,"rel":512},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fsql-insert.html",[94],"reference for INSERT","\nsays the alternative action is taken \"if an arbiter constraint or index specified\nby conflict_target is violated\". A clash on any other column refuses the row as\nbefore.",[14,516,519],{"className":517,"code":518,"language":405,"meta":23},[403],"await supabase\n  .from('settings')\n  .upsert({ user_id: user.id, theme: 'dark' }, { onConflict: 'user_id' })\n",[21,520,518],{"__ignoreMap":23},[10,522,523,526,527,530,531,534,535,540],{},[396,524,525],{},"2. That column needs a unique rule of its own."," Without one, Postgres has\nnothing to match and answers\n",[21,528,529],{},"there is no unique or exclusion constraint matching the ON CONFLICT specification",",\ncode ",[21,532,533],{},"42P10","\n(",[90,536,539],{"href":537,"rel":538},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Foptimizer\u002Futil\u002Fplancat.c",[94],"the line that raises it",").",[10,542,543,546,547,552,553,366],{},[396,544,545],{},"3. From the browser, Row Level Security reads more of your rules."," Row Level\nSecurity is the set of per-row rules Supabase checks on every request made with\nyour public key. For an upsert, Postgres's\n",[90,548,551],{"href":549,"rel":550},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fsql-createpolicy.html",[94],"reference for policies","\nsays \"SELECT permissions are required on the relation, and the rows proposed for\ninsertion are checked using the relation's SELECT policies.\" When the row exists\nand the upsert merges, the existing row is checked against the table's update\nrules as well. A row that fails either\ncheck ends the request with\n",[90,554,556],{"href":555},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","new row violates row-level security policy",[10,558,559],{},"So on the waitlist, an upsert from the browser fails until the table has a read\nrule a visitor passes. A read rule a stranger passes for any address is a rule\nthat lets strangers read your list. At the door, writing over a line means being\nshown the list first. For a table like that, refuse the duplicate instead, or use the function in the next section.",[381,561],{"alt":562,"caption":563,"src":564},"Two requests to the same table. An insert passes one gate, insert, and reaches the table. An upsert has to pass three gates in a row, insert, select and update; the select gate is shut and drawn in amber, so the upsert stops there.","From the browser, an upsert is checked against the table's read and update rules as well as its insert rule. On a table visitors may only add to, the read rule is the one that stops it.","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fupsert-reads-three-rules-1600x660.png",[35,566,568],{"id":567},"is-it-safe-to-show-this-error-to-your-users","Is it safe to show this error to your users?",[10,570,571],{},"No. Show a sentence of your own and keep the raw error in your logs, for two\nreasons: the detail line can carry the value back, and the error confirms the\nvalue exists whatever you print.",[10,573,574,577,578,581,582,589,590,366],{},[396,575,576],{},"The detail line repeats the value."," ",[21,579,580],{},"Key (email)=(maria@example.com)"," is\nharmless on Maria's own screen and very different in a screenshot posted to a\nsupport forum, in an error tracker, or on the screen of whoever typed someone\nelse's address into your form. Postgres already guards it. The function that\nbuilds the line\n(",[90,583,586],{"href":584,"rel":585},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Faccess\u002Findex\u002Fgenam.c",[94],[21,587,588],{},"BuildIndexValueDescription",")\nchecks first: \"if RLS is enabled for the relation. If so, return NULL to avoid\nleaking data.\" A request made with your public key to a table with Row Level\nSecurity on gets ",[21,591,592],{},"\"details\": null",[10,594,595,596,599,600,602,603,607],{},"Read the other way round, the line tells you about the table. If your browser\nconsole shows\n",[21,597,598],{},"Key (...)=(...)"," for a request your app made with the public key, Row Level\nSecurity is off on that table. The one exception is a request your app sends through server code holding\nthe secret key, which skips the rules entirely. ",[21,601,137],{}," proves less: Postgres also\ndrops the line when the caller cannot read every column in the key.\n",[90,604,606],{"href":605},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Turning Row Level Security on for every table","\ncovers the switch and the first rule.",[10,609,610,611,615],{},"A table with the rules off answers a stranger as readily as it answered you. Our\n",[90,612,614],{"href":613},"\u002Fsecurity-scanner","free scan"," reads your live app with the same public key a\nvisitor gets, reports which tables hand back rows, and needs no account.",[10,617,618,621,622,625,626,631],{},[396,619,620],{},"The error answers a question you may not want answered."," With the detail line\ngone, a ",[21,623,624],{},"409"," still tells whoever sent the row that the value is already there.\nPostgres's ",[90,627,630],{"href":628,"rel":629},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fddl-rowsecurity.html",[94],"page on row security","\nsays unique constraints \"always bypass row security to ensure that data integrity\nis maintained\", and asks you to design tables and rules so these checks do not\nturn into a covert channel. On the waitlist, anyone can learn whether an address\nis on your list by trying to add it. The doorman never reads the name out, and\nturning someone away still tells the queue it was there.",[10,633,634],{},"If that matters for your list, give the browser the same answer either way. A\nfunction in the database can add the address, skip it if it is already there, and\nreturn nothing in both cases:",[14,636,639],{"className":637,"code":638,"language":275,"meta":23},[273],"create function public.join_waitlist(new_email text)\nreturns void\nlanguage sql\nsecurity definer\nset search_path = ''\nas $$\n  insert into public.waitlist (email)\n  values (new_email)\n  on conflict (email) do nothing;\n$$;\n",[21,640,638],{"__ignoreMap":23},[10,642,643,644,647,648,651,652,657,658,662],{},"Your app calls ",[21,645,646],{},"supabase.rpc('join_waitlist', { new_email: email })",".\n",[21,649,650],{},"security definer"," runs the insert as the function's owner, so visitors need no\nrule on the table at all, and the rule that let them insert can go, or the old\nroute stays open beside the new one.\n",[90,653,654,655],{"href":438},"What \"Database error saving new user\" says about ",[21,656,650],{},"\nexplains what it hands over, and\n",[90,659,661],{"href":660},"\u002Fblog\u002Fsupabase-function-not-found","calling a Supabase function"," covers matching\nthe argument names.",[381,664],{"alt":665,"caption":666,"src":667},"The same duplicate sent to two tables. The table on the left carries a padlock, and its answer reads 23505 and 409 with an empty details line. The table on the right has no padlock, and its answer carries an amber details line reading Key (email)=(…).","Postgres writes the value into the detail line only for a caller Row Level Security does not apply to. Seeing it from the browser means the table's rules are off.","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fthe-detail-line-and-rls-1600x700.png",[35,669,671],{"id":670},"before-you-change-how-your-app-writes","Before you change how your app writes",[10,673,674],{},"Keep a copy of the database from before you switch an insert to an upsert or\nreset a counter, and hear about it when a table starts answering strangers.",[10,676,677],{},[396,678,679,683],{},[90,680,682],{"href":681},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database:",[421,685,686,689,692,695,698,701,704],{},[424,687,688],{},"an encrypted copy on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[424,690,691],{},"every table with its rows as they were before a merge wrote over them",[424,693,694],{},"each table's id counter put back with its rows on a restore, so the next new row gets a free number",[424,696,697],{},"each copy verified before it counts, by counting the rows in every table",[424,699,700],{},"your uploaded files as well, once you connect a Storage credential",[424,702,703],{},"a one-click restore, with a safety copy of the current state taken first",[424,705,706],{},"everything Monitor does",[10,708,709],{},[396,710,711,715],{},[90,712,714],{"href":713},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking from outside:",[421,717,718,721,724,731],{},[424,719,720],{},"whether your app is up, checked every minute",[424,722,723],{},"the full security check every hour, on up to three apps",[424,725,726,727,730],{},"a message when a result ",[396,728,729],{},"changes",", so a table that starts answering strangers after a deploy reaches you without you going to look",[424,732,733],{},"a monthly report, in plain language, of what it saw",[35,735,737],{"id":736},"what-to-do-now","What to do now",[739,740,741],"key-takeaways",{},[421,742,743,752,761,767,773],{},[424,744,745,746,748,749,751],{},"Read the name in quotes. The table and column sit before ",[21,747,215],{},", and ",[21,750,239],{}," means the primary key.",[424,753,754,755,757,758,760],{},"If the name ends in ",[21,756,239],{}," and your app sends no id, move the counter with the ",[21,759,322],{}," statement above.",[424,762,763,764,766],{},"Catch ",[21,765,81],{}," in your app and show a sentence you wrote, never the raw message.",[424,768,769,770,772],{},"Use upsert only where the new row should replace the old one, with ",[21,771,485],{}," set to the column in the error.",[424,774,775,776,778],{},"If the browser console shows a ",[21,777,598],{}," line for a request made with your public key, switch Row Level Security on for that table.",[10,780,781,782,784,785,788],{},"Start with the name in quotes, because it says which rule refused the row and\nwhich column that rule guards. Before you run a ",[21,783,322],{},", an upsert or anything\nelse that rewrites rows people depend on,\n",[90,786,787],{"href":681},"keep a copy of the database"," from before the change.",{"title":23,"searchDepth":790,"depth":790,"links":791},3,[792,794,795,796,797,798,799,800],{"id":37,"depth":793,"text":38},2,{"id":182,"depth":793,"text":183},{"id":294,"depth":793,"text":295},{"id":388,"depth":793,"text":389},{"id":446,"depth":793,"text":447},{"id":567,"depth":793,"text":568},{"id":670,"depth":793,"text":671},{"id":736,"depth":793,"text":737},"Security basics","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcover-1200x630.png","A clipboard list of names with one line lit in teal, and a slip in front of it carrying the same name in amber, held back from the list.","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.",false,"md",[808,811,813,816,819],{"q":809,"a":810},"What does duplicate key value violates unique constraint mean?","It means Postgres refused to add or change a row because another row already holds the same value in a column, or set of columns, that allows each value only once. Nothing was written. The code is 23505, and from a Supabase app it arrives as HTTP 409.",{"q":183,"a":812},"The constraint name in quotes tells you. Postgres names a unique constraint after its table and columns with _key at the end, so waitlist_email_key is the email column of the waitlist table, and a name ending in _pkey is the primary key, usually id. The detail line, when it is there, names the column and the value.",{"q":814,"a":815},"Should I use upsert?","Only when the new row should replace the old one, such as a settings row per user. Set onConflict to the column in the error, because Supabase upserts check the primary key by default. From the browser, an upsert also needs the table to have read rules the row passes, so on a table visitors may only add to it fails or forces you to open the table for reading.",{"q":817,"a":818},"Why does this happen on signup?","Two ways lead there: a trigger copies each new user into a table of yours and the value it copies is already there, or your app inserts the same profile row the trigger already made. Supabase reports either as \"Database error saving new user\", and the 23505 itself is in the Postgres logs.",{"q":820,"a":821},"Is it safe to show this error to users?","No. The detail line can repeat the value back, the message names your table and column, and the error itself tells whoever sent the row that the value exists. Catch code 23505, show a sentence you wrote, and keep the raw error in your own logs.","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",[824,825,826,827,828,829,830,831],"duplicate key value violates unique constraint","supabase duplicate key error","postgres 23505","supabase upsert duplicate","key already exists","duplicate key value violates unique constraint pkey","there is no unique or exclusion constraint matching the on conflict specification","supabase onconflict",{},true,"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","2026-10-24",{"title":5,"description":804},"blog\u002Fduplicate-key-value-violates-unique-constraint",[839,840,841],"Supabase \"duplicate key value violates unique constraint\" (Postgres code 23505, HTTP 409 in your app) means a row already holds that value in a column that allows each value once. The name in quotes says which column.","\"Key (id)=(1) already exists\" when your app sends no id means the table's id counter is behind its rows. One setval line puts it right.","Upsert only helps when onConflict names that column, and from the browser it needs the table's read rules too. Show your users a sentence of your own: the raw message can carry the value back.","6ukU5-m807zS41sjEALzL_Hoz9tjubhsk7x8TGiKsyk",[844,850,856,862,868,874,880,886,892,898,904,911,917,923,929,935,941,942,947,952,958,964,970,976,982,988,994,999,1005,1011,1017,1023,1029,1035,1041,1047,1053,1059,1065,1071,1077,1083,1089,1095,1101,1107,1112,1118,1124,1130,1136,1142,1148,1154,1160,1166,1172,1178,1184,1190,1196,1202,1207,1213,1219,1225,1231,1237,1243,1249,1255,1261,1267,1273,1279,1285,1290,1296,1302,1308,1314,1320,1326,1332,1337,1343,1349,1355,1360,1366],{"path":845,"title":846,"description":847,"published":848,"category":801,"image":849,"draft":805},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":851,"title":852,"description":853,"published":854,"category":801,"image":855,"draft":805},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":857,"title":858,"description":859,"published":860,"category":801,"image":861,"draft":805},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":863,"title":864,"description":865,"published":866,"category":801,"image":867,"draft":805},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":869,"title":870,"description":871,"published":872,"category":801,"image":873,"draft":805},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":875,"title":876,"description":877,"published":878,"category":801,"image":879,"draft":805},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":881,"title":882,"description":883,"published":884,"category":801,"image":885,"draft":805},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":887,"title":888,"description":889,"published":890,"category":801,"image":891,"draft":805},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":893,"title":894,"description":895,"published":896,"category":801,"image":897,"draft":805},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":899,"title":900,"description":901,"published":902,"category":801,"image":903,"draft":805},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":905,"title":906,"description":907,"published":908,"category":909,"image":910,"draft":805},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":912,"title":913,"description":914,"published":915,"category":801,"image":916,"draft":805},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":918,"title":919,"description":920,"published":921,"category":801,"image":922,"draft":805},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":924,"title":925,"description":926,"published":927,"category":801,"image":928,"draft":805},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":930,"title":931,"description":932,"published":933,"category":801,"image":934,"draft":805},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":936,"title":937,"description":938,"published":939,"category":801,"image":940,"draft":805},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":834,"title":5,"description":804,"published":835,"category":801,"image":822,"draft":805},{"path":364,"title":943,"description":944,"published":945,"category":801,"image":946,"draft":805},"Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":660,"title":948,"description":949,"published":950,"category":801,"image":951,"draft":805},"Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":953,"title":954,"description":955,"published":956,"category":801,"image":957,"draft":805},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":959,"title":960,"description":961,"published":962,"category":801,"image":963,"draft":805},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":965,"title":966,"description":967,"published":968,"category":801,"image":969,"draft":805},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":971,"title":972,"description":973,"published":974,"category":801,"image":975,"draft":805},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":977,"title":978,"description":979,"published":980,"category":801,"image":981,"draft":805},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":983,"title":984,"description":985,"published":986,"category":801,"image":987,"draft":805},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":989,"title":990,"description":991,"published":992,"category":801,"image":993,"draft":805},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":438,"title":995,"description":996,"published":997,"category":801,"image":998,"draft":805},"\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":1000,"title":1001,"description":1002,"published":1003,"category":801,"image":1004,"draft":805},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":1006,"title":1007,"description":1008,"published":1009,"category":801,"image":1010,"draft":805},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1012,"title":1013,"description":1014,"published":1015,"category":801,"image":1016,"draft":805},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":1018,"title":1019,"description":1020,"published":1021,"category":801,"image":1022,"draft":805},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":1024,"title":1025,"description":1026,"published":1027,"category":801,"image":1028,"draft":805},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":1030,"title":1031,"description":1032,"published":1033,"category":801,"image":1034,"draft":805},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":1036,"title":1037,"description":1038,"published":1039,"category":801,"image":1040,"draft":805},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":1042,"title":1043,"description":1044,"published":1045,"category":801,"image":1046,"draft":805},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":1048,"title":1049,"description":1050,"published":1051,"category":801,"image":1052,"draft":805},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":1054,"title":1055,"description":1056,"published":1057,"category":801,"image":1058,"draft":805},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":1060,"title":1061,"description":1062,"published":1063,"category":801,"image":1064,"draft":805},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":1066,"title":1067,"description":1068,"published":1069,"category":801,"image":1070,"draft":805},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":1072,"title":1073,"description":1074,"published":1075,"category":801,"image":1076,"draft":805},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":1078,"title":1079,"description":1080,"published":1081,"category":801,"image":1082,"draft":805},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":1084,"title":1085,"description":1086,"published":1087,"category":801,"image":1088,"draft":805},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":1090,"title":1091,"description":1092,"published":1093,"category":909,"image":1094,"draft":805},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":1096,"title":1097,"description":1098,"published":1099,"category":909,"image":1100,"draft":805},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":1102,"title":1103,"description":1104,"published":1105,"category":909,"image":1106,"draft":805},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":1108,"title":1109,"description":1110,"published":1105,"category":801,"image":1111,"draft":805},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":1113,"title":1114,"description":1115,"published":1116,"category":801,"image":1117,"draft":805},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":1119,"title":1120,"description":1121,"published":1122,"category":801,"image":1123,"draft":805},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":1125,"title":1126,"description":1127,"published":1128,"category":909,"image":1129,"draft":805},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":1131,"title":1132,"description":1133,"published":1134,"category":801,"image":1135,"draft":805},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":1137,"title":1138,"description":1139,"published":1140,"category":801,"image":1141,"draft":805},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":1143,"title":1144,"description":1145,"published":1146,"category":801,"image":1147,"draft":805},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":1149,"title":1150,"description":1151,"published":1152,"category":801,"image":1153,"draft":805},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":1155,"title":1156,"description":1157,"published":1158,"category":801,"image":1159,"draft":805},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":1161,"title":1162,"description":1163,"published":1164,"category":801,"image":1165,"draft":805},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1167,"title":1168,"description":1169,"published":1170,"category":801,"image":1171,"draft":805},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1173,"title":1174,"description":1175,"published":1176,"category":801,"image":1177,"draft":805},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1179,"title":1180,"description":1181,"published":1182,"category":909,"image":1183,"draft":805},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1185,"title":1186,"description":1187,"published":1188,"category":909,"image":1189,"draft":805},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1191,"title":1192,"description":1193,"published":1194,"category":909,"image":1195,"draft":805},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1197,"title":1198,"description":1199,"published":1200,"category":801,"image":1201,"draft":805},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":605,"title":1203,"description":1204,"published":1205,"category":801,"image":1206,"draft":805},"Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1208,"title":1209,"description":1210,"published":1211,"category":801,"image":1212,"draft":805},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1214,"title":1215,"description":1216,"published":1217,"category":801,"image":1218,"draft":805},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1220,"title":1221,"description":1222,"published":1223,"category":801,"image":1224,"draft":805},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1226,"title":1227,"description":1228,"published":1229,"category":801,"image":1230,"draft":805},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1232,"title":1233,"description":1234,"published":1235,"category":801,"image":1236,"draft":805},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1238,"title":1239,"description":1240,"published":1241,"category":801,"image":1242,"draft":805},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1244,"title":1245,"description":1246,"published":1247,"category":801,"image":1248,"draft":805},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1250,"title":1251,"description":1252,"published":1253,"category":801,"image":1254,"draft":805},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1256,"title":1257,"description":1258,"published":1259,"category":909,"image":1260,"draft":805},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1262,"title":1263,"description":1264,"published":1265,"category":801,"image":1266,"draft":805},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1268,"title":1269,"description":1270,"published":1271,"category":909,"image":1272,"draft":805},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1274,"title":1275,"description":1276,"published":1277,"category":801,"image":1278,"draft":805},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1280,"title":1281,"description":1282,"published":1283,"category":801,"image":1284,"draft":805},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":555,"title":1286,"description":1287,"published":1288,"category":801,"image":1289,"draft":805},"New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1291,"title":1292,"description":1293,"published":1294,"category":801,"image":1295,"draft":805},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1297,"title":1298,"description":1299,"published":1300,"category":909,"image":1301,"draft":805},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1303,"title":1304,"description":1305,"published":1306,"category":909,"image":1307,"draft":805},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1309,"title":1310,"description":1311,"published":1312,"category":801,"image":1313,"draft":805},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1315,"title":1316,"description":1317,"published":1318,"category":801,"image":1319,"draft":805},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1321,"title":1322,"description":1323,"published":1324,"category":909,"image":1325,"draft":805},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1327,"title":1328,"description":1329,"published":1330,"category":801,"image":1331,"draft":805},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1333,"title":1334,"description":1335,"published":1330,"category":801,"image":1336,"draft":805},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1338,"title":1339,"description":1340,"published":1341,"category":801,"image":1342,"draft":805},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1344,"title":1345,"description":1346,"published":1347,"category":909,"image":1348,"draft":805},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1350,"title":1351,"description":1352,"published":1353,"category":801,"image":1354,"draft":805},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1356,"title":1357,"description":1358,"published":1353,"category":909,"image":1359,"draft":805},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1361,"title":1362,"description":1363,"published":1364,"category":909,"image":1365,"draft":805},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1367,"title":1368,"description":1369,"published":1364,"category":801,"image":1370,"draft":805},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]