[{"data":1,"prerenderedAt":1254},["ShallowReactive",2],{"blog-en-edge-function-returned-a-non-2xx-status-code":3,"blog-index-en":728},{"id":4,"title":5,"body":6,"category":686,"cover":687,"coverAlt":688,"description":689,"draft":690,"extension":691,"faq":692,"image":707,"keywords":708,"meta":716,"navigation":717,"ogTitle":718,"path":719,"published":720,"seo":721,"stem":722,"tldr":723,"updated":720,"__hash__":727},"blog_en\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code.md","\"Edge Function returned a non-2xx status code\" in Supabase",{"type":7,"value":8,"toc":673},"minimark",[9,13,24,27,35,40,43,62,65,82,88,92,95,120,133,139,171,175,178,299,314,318,321,337,343,362,379,383,391,408,437,440,461,466,470,473,508,514,518,521,541,556,564,571,575,581,590,604,614,631,635,661],[10,11,12],"p",{},"You press the button in your app that calls an Edge Function, and instead of a\nresult your app shows this:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","Edge Function returned a non-2xx status code\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26],{},"It is the same sentence whatever went wrong. A missing key, a function that\ncrashed, a request turned away before your code ran: all of them read\n\"Edge Function returned a non-2xx status code\", so the message on its own tells\nyou almost nothing about what to fix.",[10,28,29,30,34],{},"What it does not tell you is that the reason has already arrived. ",[31,32,33],"strong",{},"The error\ncame back in the same reply as that sentence, and supabase-js does not read it\nout to you."," Searching the sentence gets you other people's guesses. Reading\nthe reply gets you your own answer.",[36,37,39],"h2",{"id":38},"what-does-edge-function-returned-a-non-2xx-status-code-mean","What does \"Edge Function returned a non-2xx status code\" mean?",[10,41,42],{},"Your function answered, and the answer was an error. That is all the sentence\nsays.",[10,44,45,46,49,50,57,58,61],{},"Every reply on the web carries a status code, a three-digit number saying how\nthe request went. Anything in the 200s means it worked. When your app calls a\nfunction through ",[21,47,48],{},"supabase.functions.invoke",", supabase-js looks at that number,\nand if it is outside the 200s it hands your app a fixed sentence in place of the\ndata. The sentence is written into\n",[51,52,56],"a",{"href":53,"rel":54},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase-js\u002Fblob\u002Fmaster\u002Fpackages\u002Fcore\u002Ffunctions-js\u002Fsrc\u002Ftypes.ts",[55],"nofollow","supabase-js itself",",\nword for word, and the error it comes with is called a ",[21,59,60],{},"FunctionsHttpError",".",[10,63,64],{},"Think of the call as a letter you post to a back office. The office either\nanswers what you asked or sends the letter back. When it comes back,\nsupabase-js reads the stamp on the envelope and tells you it was returned. It\ndoes not open the envelope. The note inside says why, and the office kept a\nlogbook of everything that happened while your letter was there.",[10,66,67,68,71,72,76,77,81],{},"Two close relatives look similar and mean something else. ",[21,69,70],{},"Failed to send a request to the Edge Function"," means no readable reply came back at all, and in\na browser that is often a missing CORS header, which\n",[51,73,75],{"href":74},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","the post on that message","\ncovers. And if several unrelated parts of your app broke at the same moment,\ncheck ",[51,78,80],{"href":79},"\u002Fblog\u002Fis-supabase-down-or-your-app","whether it is Supabase or your app","\nbefore you open any code.",[83,84],"diagram",{"alt":85,"caption":86,"src":87},"A request leaves the browser for an Edge Function. The reply that comes back carries a status of 500 and a body full of lines. supabase-js reduces it to one grey bar for the app, while a dashed line leads from the bar back to the open reply and on to the function's log.","The reply carries the status and the reason. supabase-js passes your app one sentence, and the reason stays attached to the error and in the function's log.","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fthe-reason-rides-back-1600x740.png",[36,89,91],{"id":90},"where-is-the-real-error","Where is the real error?",[10,93,94],{},"In two places, and you can read both without changing a line of code.",[10,96,97,100,101,104,105,108,109,112,113,116,117,61],{},[31,98,99],{},"The reply itself."," Open your live app in Chrome, Edge or Firefox, press F12,\nchoose the ",[31,102,103],{},"Network"," tab and repeat whatever failed. Click the request whose\naddress contains ",[21,106,107],{},"\u002Ffunctions\u002Fv1\u002F"," followed by your function's name. Its\n",[31,110,111],{},"Status"," column has the number, and its ",[31,114,115],{},"Response"," tab has whatever the\nfunction sent back with it: a message your own code wrote, a short JSON body\nfrom Supabase's platform, or the words ",[21,118,119],{},"Internal Server Error",[10,121,122,123,128,129,132],{},"If you, or the tool that writes your code, can change the call, Supabase's\n",[51,124,127],{"href":125,"rel":126},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Ferror-handling",[55],"error handling guide","\nshows how to read the same reply inside the app, because the original response\ntravels with the error as ",[21,130,131],{},"error.context",":",[14,134,137],{"className":135,"code":136,"language":19},[17],"const { data, error } = await supabase.functions.invoke('your-function', { body })\nif (error) console.log(error.context.status, await error.context.text())\n",[21,138,136],{"__ignoreMap":23},[10,140,141,144,145,148,149,152,153,156,157,162,163,166,167,170],{},[31,142,143],{},"The function's logbook."," In the Supabase dashboard, open ",[31,146,147],{},"Edge Functions",",\npick the function, and read two tabs. ",[31,150,151],{},"Invocations"," lists every request with\nits status code and how long it took. ",[31,154,155],{},"Logs"," holds what Supabase's\n",[51,158,161],{"href":159,"rel":160},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Flogging",[55],"logging guide"," calls\nplatform events, uncaught exceptions and custom log messages, which means\nanything your code printed with ",[21,164,165],{},"console.log"," or ",[21,168,169],{},"console.error",". Reproduce the\nfailure once, note the time, and read both tabs at that minute.",[36,172,174],{"id":173},"read-the-status-code-first","Read the status code first",[10,176,177],{},"The number tells you how far your request got before it was turned back, and\nthat decides where the reason is written down.",[179,180,181,196],"table",{},[182,183,184],"thead",{},[185,186,187,190,193],"tr",{},[188,189,111],"th",{},[188,191,192],{},"What happened",[188,194,195],{},"Where the reason is",[197,198,199,220,236,249,262,275,288],"tbody",{},[185,200,201,207,210],{},[202,203,204],"td",{},[21,205,206],{},"401",[202,208,209],{},"Refused before your code ran, or your code refused it",[202,211,212,213,166,216,219],{},"The reply. ",[21,214,215],{},"Invalid JWT",[21,217,218],{},"Missing authorization header"," is the platform",[185,221,222,227,230],{},[202,223,224],{},[21,225,226],{},"404",[202,228,229],{},"No function with that name is deployed in this project",[202,231,232,233],{},"The reply reads ",[21,234,235],{},"Requested function was not found",[185,237,238,243,246],{},[202,239,240],{},[21,241,242],{},"500",[202,244,245],{},"Your code ran and threw an error, or returned a 500 on purpose",[202,247,248],{},"The Logs tab",[185,250,251,256,259],{},[202,252,253],{},[21,254,255],{},"503",[202,257,258],{},"The function failed to start at all",[202,260,261],{},"The Logs tab: an import, a syntax error or the function's configuration",[185,263,264,269,272],{},[202,265,266],{},[21,267,268],{},"504",[202,270,271],{},"No reply within 150 seconds",[202,273,274],{},"The Invocations tab, then whatever your code was waiting on",[185,276,277,282,285],{},[202,278,279],{},[21,280,281],{},"546",[202,283,284],{},"It ran out of CPU time or memory",[202,286,287],{},"The Logs tab says which",[185,289,290,293,296],{},[202,291,292],{},"Any other 4xx",[202,294,295],{},"Your own code chose it, for example by passing on a service's answer",[202,297,298],{},"The reply",[10,300,301,302,307,308,313],{},"The meanings come from Supabase's\n",[51,303,306],{"href":304,"rel":305},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Fstatus-codes",[55],"status code reference","\nand its ",[51,309,312],{"href":310,"rel":311},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Flimits",[55],"limits page",". A 404\nneeds no more than this table: check the function's name in your app against\nthe list in the dashboard, and check it is deployed to the project your app\ntalks to. The other rows have a section each below.",[36,315,317],{"id":316},"_500-your-function-ran-and-failed","500: your function ran and failed",[10,319,320],{},"Something in your code threw an error, and the Logs tab has the line.",[10,322,323,324,329,330,332,333,336],{},"Supabase's ",[51,325,328],{"href":326,"rel":327},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fedge-function-500-error-response",[55],"page on this error","\nsplits it in two. If the reply says exactly ",[21,331,119],{},", your code\ncrashed and the log shows the type of error and the line it happened on, such as\n",[21,334,335],{},"TypeError: Cannot read properties of undefined",". If the reply says anything\nelse, your code wrote that message itself and returned the 500 on purpose, so\nsearch the function for the status it sent.",[10,338,339,340],{},"One cause is worth ruling out before any other in a function that calls OpenAI,\nStripe or any paid API: ",[31,341,342],{},"a secret that exists on your machine and not on your\nlive project.",[10,344,345,346,349,350,358,359,361],{},"Inside the function, a secret is read with ",[21,347,348],{},"Deno.env.get('OPENAI_API_KEY')",".\nWhen no secret by that name is set, Deno's documentation says this\n",[51,351,354,355],{"href":352,"rel":353},"https:\u002F\u002Fdocs.deno.com\u002Fapi\u002Fdeno\u002F~\u002FDeno.Env.get",[55],"returns ",[21,356,357],{},"undefined"," instead of\nfailing. So the function carries on, builds a request with the word ",[21,360,357],{},"\nwhere the key should be, and sends it. OpenAI answers with its own 401,\n\"Incorrect API key provided\", and your function either passes that on or falls\nover trying to read a reply it did not expect. In the envelope picture, the\noffice opened your letter, went to the drawer where the key should be, found it\nempty, and sent back a note about a wrong key.",[10,363,364,365,368,369,374,375,378],{},"The repair is on the ",[31,366,367],{},"Edge Function Secrets"," page of your Supabase project.\nSupabase's ",[51,370,373],{"href":371,"rel":372},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Fsecrets",[55],"secrets guide","\nsays a function reads a new secret immediately, so you do not redeploy, and that\nno secret name may start with ",[21,376,377],{},"SUPABASE_",", because that prefix is reserved for\nthe values Supabase sets for you. A secret you set for local development stays\non your machine; the live project has its own list.",[36,380,382],{"id":381},"_401-refused-before-your-code-ran","401: refused before your code ran",[10,384,385,386,166,388,390],{},"If the reply says ",[21,387,215],{},[21,389,218],{},", your function\nnever saw the request. Supabase's platform turned it away at the door.",[10,392,393,394,397,398,401,402,407],{},"That door is a check called ",[21,395,396],{},"verify_jwt",", on by default, which reads the\n",[21,399,400],{},"Authorization"," header of every request before your code runs. Supabase's\n",[51,403,406],{"href":404,"rel":405},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fedge-function-401-error-response",[55],"page on the 401","\nlists three ways to fail it:",[409,410,411,418,431],"ul",{},[412,413,414,417],"li",{},[31,415,416],{},"The key does not match your project's keys."," For example a key copied from\nanother project, or an old one still set somewhere after a rotation.",[412,419,420,426,427,430],{},[31,421,422,423,425],{},"There is no ",[21,424,400],{}," header at all."," supabase-js adds one for you.\nA plain ",[21,428,429],{},"fetch"," to the function's address, or a webhook from another service,\ndoes not.",[412,432,433,436],{},[31,434,435],{},"Your project uses Supabase's newer signing keys."," The built-in check only\nunderstands the older format, and Supabase's fix is to switch the check off\nfor that function.",[10,438,439],{},"That last point goes further than one case. Supabase now recommends turning the\nbuilt-in check off and managing authentication directly in your function code.\nThe recommendation has two halves, and the second is the one that gets dropped.",[10,441,442,443,446,447,451,452,455,456,460],{},"If the 401 came with a message your own code wrote, the platform let it\nthrough and your function refused it, or passed on a 401 from the service it\ncalled, which is often the empty secret from the 500 section. This is\nalso a different check from the one behind ",[21,444,445],{},"PGRST301"," on your database queries,\nwhich ",[51,448,450],{"href":449},"\u002Fblog\u002Fsupabase-invalid-jwt","has a page of its own",". If the function's\nlog shows ",[21,453,454],{},"invalid claim: missing sub claim",", it asked Supabase Auth who was\ncalling and was handed your project's key instead of a signed-in user, which\n",[51,457,459],{"href":458},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","that message's own post"," traces.",[83,462],{"alt":463,"caption":464,"src":465},"A request travels from the browser through a gate, into the function, and on to an outside service. Each place it can stop is marked with its number: 401 at the gate, 404 where no function stands at the address, 500 inside the function, 546 and 504 on a clock beside it, and a 401 from the outside service that the function passes back.","The status says how far the request got. A 401 at the gate never reached your code; a 401 passed back from the service it called did.","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fhow-far-it-got-1600x720.png",[36,467,469],{"id":468},"_546-and-504-out-of-resources-or-out-of-time","546 and 504: out of resources or out of time",[10,471,472],{},"Supabase stops a function that uses too much, and the two numbers say which\nlimit it hit.",[10,474,475,478,479,482,483,486,487,490,491,494,495,166,498,501,502,507],{},[31,476,477],{},"546 is compute."," The ",[51,480,312],{"href":310,"rel":481},[55],"\ngives a function 256 MB of memory and each request 2 seconds of CPU time. Go\nover either and the reply reads\n",[21,484,485],{},"Function failed due to not having enough compute resources (please check logs)",",\nwith the code ",[21,488,489],{},"WORKER_RESOURCE_LIMIT"," (older logs say ",[21,492,493],{},"WORKER_LIMIT","). The Logs\ntab says ",[21,496,497],{},"CPU Time exceeded",[21,499,500],{},"Memory limit exceeded",". Supabase's\n",[51,503,506],{"href":504,"rel":505},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fedge-function-546-error-response",[55],"page on the 546","\ngives image processing, AI embeddings and web scraping as its examples, and its\nanswer is to do less per request or hand the heavy part to another service.",[10,509,510,513],{},[31,511,512],{},"504 is time."," A function that sends no reply within 150 seconds gets a 504.\nThe CPU limit counts only the time your code is actually computing: the limits\npage says it does not include async I\u002FO, which is what waiting on the network\nis. So a function that sits waiting for a slow AI model is not spending CPU. It\nis running down the 150-second clock, and when that runs out you get a 504\nrather than a 546.",[36,515,517],{"id":516},"two-fixes-that-make-it-worse","Two fixes that make it worse",[10,519,520],{},"Two changes make this message go away within minutes, and both leave you worse\noff than the error did.",[10,522,523,526,527,530,531,535,536,540],{},[31,524,525],{},"Calling the API from the page instead."," The quickest way to stop a failing\nfunction from failing is to stop using it: put the key in a ",[21,528,529],{},"VITE_"," variable\nand call OpenAI straight from your frontend. It works on the first try. It also\nputs the key in the file every visitor downloads, because that prefix is\n",[51,532,534],{"href":533},"\u002Fblog\u002Fvite-and-next-public-env-vars","an instruction to compile the value into your bundle",",\nand anyone can read it there. Across the live apps we have scanned, an OpenAI key\nturned up in the JavaScript of 33, and\n",[51,537,539],{"href":538},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","what a stranger can do with one","\nhas a post of its own.",[10,542,543,546,547,549,550,555],{},[31,544,545],{},"Switching off the check and stopping there."," Clearing a 401 by turning off\n",[21,548,396],{}," is the first half of Supabase's own advice. Supabase's\n",[51,551,554],{"href":552,"rel":553},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Ffunction-configuration",[55],"configuration guide","\nis plain about what it does alone:\n\"it will allow anyone to invoke your Edge Function without a valid JWT\". Your\nfunction's address is in your frontend for anyone to read. If the function\nholds an OpenAI key, a stranger can now spend it through you. If it uses the\nproject's secret key, which Supabase places in every function's environment, a\nstranger's request runs with a key that gets past every row level security rule\nyou wrote.",[10,557,558,559,563],{},"The second half, a check on who is calling written into the function, is a few\nlines. ",[51,560,562],{"href":561},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Moving a secret into an Edge Function","\nhas them, and it explains why even the default check lets more callers through\nthan its name suggests.",[10,565,566,567,61],{},"You can see the first mistake from outside, which is how we counted it. Our free\nscan reads your live app's JavaScript the way a stranger would and names every\nkey it finds, including whether it is one that belongs there. It takes about 20\nseconds and needs no account: ",[51,568,570],{"href":569},"\u002Fsecurity-scanner","scan your app",[36,572,574],{"id":573},"keeping-the-key-where-you-put-it","Keeping the key where you put it",[10,576,577,580],{},[31,578,579],{},"The fix you make today can be undone by next week's prompt."," A builder asked\nto make a feature work again is free to take the shortcut above, and your app\nkeeps working while it does.",[10,582,583],{},[31,584,585,589],{},[51,586,588],{"href":587},"\u002Fwebsite-monitoring","Reeve Monitor"," checks every hour so you do not have to:",[409,591,592,595,598,601],{},[412,593,594],{},"all nine checks every hour, on up to three apps",[412,596,597],{},"an email the day a re-scan grades your app lower than the one before; a secret key in your JavaScript caps the grade at D on its own",[412,599,600],{},"whether the app is up, every 60 seconds",[412,602,603],{},"a monthly report of what it saw",[10,605,606],{},[31,607,608,609,613],{},"A function running with your secret key gets past every row level security\nrule. ",[51,610,612],{"href":611},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database\nwhere nothing in your project can reach it.",[409,615,616,619,622,625,628],{},[412,617,618],{},"an encrypted copy on a schedule, kept on Reeve's own storage in the EU, outside your Supabase account",[412,620,621],{},"each copy verified before it counts, by counting the rows in every table",[412,623,624],{},"a one-click restore that saves what is there now before it replaces anything",[412,626,627],{},"your uploaded files as well, once you connect a Storage credential",[412,629,630],{},"everything Monitor does",[36,632,634],{"id":633},"what-to-do-now","What to do now",[636,637,638],"key-takeaways",{},[409,639,640,643,646,649,652,655],{},[412,641,642],{},"Reproduce the failure once and note the time.",[412,644,645],{},"Open the request in your browser's Network tab and read its status and its response before you change anything.",[412,647,648],{},"Read the function's Invocations and Logs tabs in the Supabase dashboard at that minute.",[412,650,651],{},"On a 500 from a function that calls a paid API, check the secret is set on the live project's Edge Function Secrets page. No redeploy is needed after.",[412,653,654],{},"On a 401 from the platform, fix the key or switch the built-in check off, and add a check on who is calling inside the function in the same change.",[412,656,657,658,660],{},"Never clear this error by moving the key into a ",[21,659,529],{}," variable.",[10,662,663,664,667,668,672],{},"The check on who is calling is the step that is easiest to skip, and\n",[51,665,666],{"href":561},"the Edge Function secrets walkthrough","\ncovers it in full. The ",[51,669,671],{"href":670},"\u002Fchecklist","10-minute security checklist"," covers what\nelse tends to be left open in a newly launched app.",{"title":23,"searchDepth":674,"depth":674,"links":675},3,[676,678,679,680,681,682,683,684,685],{"id":38,"depth":677,"text":39},2,{"id":90,"depth":677,"text":91},{"id":173,"depth":677,"text":174},{"id":316,"depth":677,"text":317},{"id":381,"depth":677,"text":382},{"id":468,"depth":677,"text":469},{"id":516,"depth":677,"text":517},{"id":573,"depth":677,"text":574},{"id":633,"depth":677,"text":634},"Security basics","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcover-1200x630.png","An envelope sent back with a stamp in amber across its face and its flap open, showing the folded letter still inside.","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.",false,"md",[693,695,698,701,704],{"q":39,"a":694},"It means your Supabase Edge Function replied with an error status, any number outside the 200s, and supabase-js turned that reply into one fixed sentence. The sentence is the same for a crash, a missing key, a request refused before your code ran and a timeout. The reply itself, which says which of those it was, is still attached to the error, and the function keeps a log of its own.",{"q":696,"a":697},"How do I see the real error behind it?","Open your live app, press F12, choose the Network tab and repeat whatever failed. Click the request whose address contains \u002Ffunctions\u002Fv1\u002F and read its status and its response: that is what the function actually sent. Then open Edge Functions in your Supabase dashboard, pick the function, and read the Invocations and Logs tabs at the same time. In code, Supabase's guide reads the same reply with await error.context.json().",{"q":699,"a":700},"Why does my Edge Function work locally but fail when deployed?","Check first whether a secret exists on your machine and not on your live project. The local stack reads its own environment file, and the deployed function reads the secrets set on the project. A secret that is missing comes back as undefined rather than as an error, so the function carries on and fails later, usually when the service it calls refuses an empty key. Set it on the Edge Function Secrets page; Supabase says a new secret is read immediately, with no redeploy.",{"q":702,"a":703},"Should I turn off JWT verification to fix a 401?","Supabase now recommends turning the built-in check off and checking the caller inside your function instead. Both halves matter. Turned off on its own, the check stops nothing, and Supabase's own docs warn that this lets anyone invoke your function without a valid JWT. If the function holds an OpenAI key or the project's secret key, that is anyone on the internet spending your quota or reaching past your row level security rules.",{"q":705,"a":706},"What does error 546 mean on a Supabase Edge Function?","The function ran out of compute: more than 2 seconds of CPU time, or more than its memory allowance, on one request. The reply reads \"Function failed due to not having enough compute resources (please check logs)\", and the Logs tab says which limit it was, CPU Time exceeded or Memory limit exceeded. Waiting on a slow API does not count as CPU time; a function that waits too long gets a 504 instead.","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",[709,710,60,711,712,713,714,715],"edge function returned a non-2xx status code","supabase edge function error","supabase functions invoke error","supabase edge function 500","supabase edge function 401","supabase edge function logs","lovable edge function error",{},true,"\"Edge Function returned a non-2xx status code\"","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","2026-10-27",{"title":5,"description":689},"blog\u002Fedge-function-returned-a-non-2xx-status-code",[724,725,726],"\"Edge Function returned a non-2xx status code\" is what supabase-js says about any reply from your function outside the 200s. The real reason came back in the same reply, and the function's logs hold the rest.","Read the status number first. 401 means the request was refused before your code ran, 404 that no function by that name is deployed, 500 that your code failed, 546 or 504 that it ran out of resources or time.","Two quick fixes make the message stop and open a hole: calling the API from your frontend with the key in it, and switching off JWT verification with no check of your own in its place.","xnuciDEcXWKL_KzkOQ6LGP2pT8uVs9vO9dTGO3B6sU8",[729,735,741,747,753,759,764,769,775,781,787,794,800,806,807,813,819,825,831,837,843,849,855,861,867,872,878,884,890,896,902,908,914,920,926,932,937,943,949,955,960,966,972,978,984,990,995,1001,1007,1013,1019,1025,1031,1037,1042,1048,1054,1060,1066,1072,1078,1084,1090,1096,1102,1108,1114,1120,1126,1131,1137,1143,1149,1155,1161,1167,1173,1179,1185,1191,1197,1203,1209,1215,1220,1226,1232,1238,1243,1249],{"path":730,"title":731,"description":732,"published":733,"category":686,"image":734,"draft":690},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":736,"title":737,"description":738,"published":739,"category":686,"image":740,"draft":690},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":742,"title":743,"description":744,"published":745,"category":686,"image":746,"draft":690},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":748,"title":749,"description":750,"published":751,"category":686,"image":752,"draft":690},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":754,"title":755,"description":756,"published":757,"category":686,"image":758,"draft":690},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":458,"title":760,"description":761,"published":762,"category":686,"image":763,"draft":690},"Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":74,"title":765,"description":766,"published":767,"category":686,"image":768,"draft":690},"\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":770,"title":771,"description":772,"published":773,"category":686,"image":774,"draft":690},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":776,"title":777,"description":778,"published":779,"category":686,"image":780,"draft":690},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":782,"title":783,"description":784,"published":785,"category":686,"image":786,"draft":690},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":788,"title":789,"description":790,"published":791,"category":792,"image":793,"draft":690},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":795,"title":796,"description":797,"published":798,"category":686,"image":799,"draft":690},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":801,"title":802,"description":803,"published":804,"category":686,"image":805,"draft":690},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":719,"title":5,"description":689,"published":720,"category":686,"image":707,"draft":690},{"path":808,"title":809,"description":810,"published":811,"category":686,"image":812,"draft":690},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":814,"title":815,"description":816,"published":817,"category":686,"image":818,"draft":690},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":820,"title":821,"description":822,"published":823,"category":686,"image":824,"draft":690},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":826,"title":827,"description":828,"published":829,"category":686,"image":830,"draft":690},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":832,"title":833,"description":834,"published":835,"category":686,"image":836,"draft":690},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":838,"title":839,"description":840,"published":841,"category":686,"image":842,"draft":690},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":844,"title":845,"description":846,"published":847,"category":686,"image":848,"draft":690},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":850,"title":851,"description":852,"published":853,"category":686,"image":854,"draft":690},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":856,"title":857,"description":858,"published":859,"category":686,"image":860,"draft":690},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":862,"title":863,"description":864,"published":865,"category":686,"image":866,"draft":690},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":449,"title":868,"description":869,"published":870,"category":686,"image":871,"draft":690},"Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":873,"title":874,"description":875,"published":876,"category":686,"image":877,"draft":690},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":879,"title":880,"description":881,"published":882,"category":686,"image":883,"draft":690},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":885,"title":886,"description":887,"published":888,"category":686,"image":889,"draft":690},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":891,"title":892,"description":893,"published":894,"category":686,"image":895,"draft":690},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":897,"title":898,"description":899,"published":900,"category":686,"image":901,"draft":690},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":903,"title":904,"description":905,"published":906,"category":686,"image":907,"draft":690},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":909,"title":910,"description":911,"published":912,"category":686,"image":913,"draft":690},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":915,"title":916,"description":917,"published":918,"category":686,"image":919,"draft":690},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":921,"title":922,"description":923,"published":924,"category":686,"image":925,"draft":690},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":927,"title":928,"description":929,"published":930,"category":686,"image":931,"draft":690},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":561,"title":933,"description":934,"published":935,"category":686,"image":936,"draft":690},"Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":938,"title":939,"description":940,"published":941,"category":686,"image":942,"draft":690},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":944,"title":945,"description":946,"published":947,"category":686,"image":948,"draft":690},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":950,"title":951,"description":952,"published":953,"category":686,"image":954,"draft":690},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":79,"title":956,"description":957,"published":958,"category":686,"image":959,"draft":690},"Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":961,"title":962,"description":963,"published":964,"category":686,"image":965,"draft":690},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":967,"title":968,"description":969,"published":970,"category":686,"image":971,"draft":690},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":973,"title":974,"description":975,"published":976,"category":792,"image":977,"draft":690},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":979,"title":980,"description":981,"published":982,"category":792,"image":983,"draft":690},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":985,"title":986,"description":987,"published":988,"category":792,"image":989,"draft":690},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":991,"title":992,"description":993,"published":988,"category":686,"image":994,"draft":690},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":996,"title":997,"description":998,"published":999,"category":686,"image":1000,"draft":690},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":1002,"title":1003,"description":1004,"published":1005,"category":686,"image":1006,"draft":690},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":1008,"title":1009,"description":1010,"published":1011,"category":792,"image":1012,"draft":690},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":1014,"title":1015,"description":1016,"published":1017,"category":686,"image":1018,"draft":690},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":1020,"title":1021,"description":1022,"published":1023,"category":686,"image":1024,"draft":690},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":1026,"title":1027,"description":1028,"published":1029,"category":686,"image":1030,"draft":690},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":1032,"title":1033,"description":1034,"published":1035,"category":686,"image":1036,"draft":690},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":533,"title":1038,"description":1039,"published":1040,"category":686,"image":1041,"draft":690},"Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":1043,"title":1044,"description":1045,"published":1046,"category":686,"image":1047,"draft":690},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1049,"title":1050,"description":1051,"published":1052,"category":686,"image":1053,"draft":690},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1055,"title":1056,"description":1057,"published":1058,"category":686,"image":1059,"draft":690},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1061,"title":1062,"description":1063,"published":1064,"category":792,"image":1065,"draft":690},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1067,"title":1068,"description":1069,"published":1070,"category":792,"image":1071,"draft":690},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1073,"title":1074,"description":1075,"published":1076,"category":792,"image":1077,"draft":690},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1079,"title":1080,"description":1081,"published":1082,"category":686,"image":1083,"draft":690},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":1085,"title":1086,"description":1087,"published":1088,"category":686,"image":1089,"draft":690},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1091,"title":1092,"description":1093,"published":1094,"category":686,"image":1095,"draft":690},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1097,"title":1098,"description":1099,"published":1100,"category":686,"image":1101,"draft":690},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1103,"title":1104,"description":1105,"published":1106,"category":686,"image":1107,"draft":690},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1109,"title":1110,"description":1111,"published":1112,"category":686,"image":1113,"draft":690},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1115,"title":1116,"description":1117,"published":1118,"category":686,"image":1119,"draft":690},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1121,"title":1122,"description":1123,"published":1124,"category":686,"image":1125,"draft":690},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":538,"title":1127,"description":1128,"published":1129,"category":686,"image":1130,"draft":690},"Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1132,"title":1133,"description":1134,"published":1135,"category":686,"image":1136,"draft":690},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1138,"title":1139,"description":1140,"published":1141,"category":792,"image":1142,"draft":690},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1144,"title":1145,"description":1146,"published":1147,"category":686,"image":1148,"draft":690},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1150,"title":1151,"description":1152,"published":1153,"category":792,"image":1154,"draft":690},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1156,"title":1157,"description":1158,"published":1159,"category":686,"image":1160,"draft":690},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1162,"title":1163,"description":1164,"published":1165,"category":686,"image":1166,"draft":690},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1168,"title":1169,"description":1170,"published":1171,"category":686,"image":1172,"draft":690},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1174,"title":1175,"description":1176,"published":1177,"category":686,"image":1178,"draft":690},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1180,"title":1181,"description":1182,"published":1183,"category":792,"image":1184,"draft":690},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1186,"title":1187,"description":1188,"published":1189,"category":792,"image":1190,"draft":690},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1192,"title":1193,"description":1194,"published":1195,"category":686,"image":1196,"draft":690},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1198,"title":1199,"description":1200,"published":1201,"category":686,"image":1202,"draft":690},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1204,"title":1205,"description":1206,"published":1207,"category":792,"image":1208,"draft":690},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1210,"title":1211,"description":1212,"published":1213,"category":686,"image":1214,"draft":690},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1216,"title":1217,"description":1218,"published":1213,"category":686,"image":1219,"draft":690},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1221,"title":1222,"description":1223,"published":1224,"category":686,"image":1225,"draft":690},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1227,"title":1228,"description":1229,"published":1230,"category":792,"image":1231,"draft":690},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1233,"title":1234,"description":1235,"published":1236,"category":686,"image":1237,"draft":690},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1239,"title":1240,"description":1241,"published":1236,"category":792,"image":1242,"draft":690},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1244,"title":1245,"description":1246,"published":1247,"category":792,"image":1248,"draft":690},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1250,"title":1251,"description":1252,"published":1247,"category":686,"image":1253,"draft":690},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]