[{"data":1,"prerenderedAt":1204},["ShallowReactive",2],{"blog-en-email-link-is-invalid-or-has-expired":3,"blog-index-en":677},{"id":4,"title":5,"body":6,"category":632,"cover":633,"coverAlt":634,"description":635,"draft":636,"extension":637,"faq":638,"image":657,"keywords":658,"meta":665,"navigation":666,"ogTitle":667,"path":668,"published":669,"seo":670,"stem":671,"tldr":672,"updated":669,"__hash__":676},"blog_en\u002Fblog\u002Femail-link-is-invalid-or-has-expired.md","Supabase \"Email link is invalid or has expired\" on a fresh link",{"type":7,"value":8,"toc":619},"minimark",[9,13,24,27,30,38,43,46,61,85,92,96,99,114,117,123,126,142,146,149,161,178,190,194,197,206,209,215,222,226,233,240,246,257,321,329,333,336,342,348,384,390,396,407,411,414,424,430,433,439,445,459,462,468,475,494,499,502,508,514,518,521,530,544,553,573,577,608],[10,11,12],"p",{},"A new user signs up, opens the confirmation email a minute later and presses\nthe button. Your app opens on its home page, still signed out, and the address\nbar ends in this:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","#error=access_denied&error_code=otp_expired&error_description=Email+link+is+invalid+or+has+expired\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26],{},"You sign up with your own address to check. The link works the first time, and\nevery time after that.",[10,28,29],{},"Supabase says \"Email link is invalid or has expired\" when the token in an email\nlink has been used already, has been replaced, or has outlived its hour. On a\nlink that arrived a minute ago, the usual reason is that something used it\nbefore your user did: a mail filter that opens links to check them. Your\nLovable, Bolt, v0, Cursor, Claude Code or Replit app is working as built, and\nthe email it sends can be changed so that a filter has nothing to use up.",[10,31,32,33,37],{},"Here is the part the usual advice gets wrong: ",[34,35,36],"strong",{},"\"ask them to try again\" and\n\"make the link last longer\" both fail against a filter."," A second link goes\nthrough the same filter and meets the same end, however long it would have\nlasted.",[39,40,42],"h2",{"id":41},"what-does-email-link-is-invalid-or-has-expired-mean-in-supabase","What does \"Email link is invalid or has expired\" mean in Supabase?",[10,44,45],{},"It means Supabase Auth, the part of Supabase that signs people in, could not\nfind a token it was willing to accept behind the link.",[10,47,48,49,56,57,60],{},"The message is written into the Auth server's own code. In\n",[50,51,55],"a",{"href":52,"rel":53},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Fapi\u002Fverify.go",[54],"nofollow","the function that checks an email link",",\nit is returned in two places: when no waiting token matches the one in the\nlink, and when the token that matches was sent longer ago than your project\nallows. Both answers are HTTP 403 with the code ",[21,58,59],{},"otp_expired",", so the message\nalone cannot tell you which of the two happened.",[10,62,63,64,67,68,71,72,75,76,79,80,84],{},"Your user never sees the 403. The link in the email points at your Supabase\nproject's own address, which checks the token and then sends the browser on to\nyour app. When the check fails, Supabase puts three things in the part of your\napp's address after the ",[21,65,66],{},"#",": ",[21,69,70],{},"error=access_denied",", ",[21,73,74],{},"error_code=otp_expired"," and\nthe message itself. If your app was set up with the PKCE flow, they are in the\npart after the ",[21,77,78],{},"?"," as well. Unless a page in your app reads them, the person\nsees whatever your app shows a visitor who is not signed in, with no word about\nwhy. A password reset page that shows its form anyway fails on save with\n\"Auth session missing!\", because the link signed nobody in, and\n",[50,81,83],{"href":82},"\u002Fblog\u002Fauth-session-missing","that message has a post of its own",".",[10,86,87,88,84],{},"Think of the link as a ticket that admits one person, once. Whoever hands it in\nfirst walks through, and the ticket is punched. \"Email link is invalid or has\nexpired\" is the person at the door holding up a ticket with a hole already in\nit, or one whose time ran out. If your users get in and are thrown out later,\nthat is a different error with\n",[50,89,91],{"href":90},"\u002Fblog\u002Fsupabase-users-logged-out","a page of its own",[39,93,95],{"id":94},"why-a-link-sent-a-minute-ago-is-already-used","Why a link sent a minute ago is already used",[10,97,98],{},"Because something opened it before your user did, and opening a Supabase email\nlink is the same as using it.",[10,100,101,102,107,108,113],{},"Supabase's\n",[50,103,106],{"href":104,"rel":105},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fauth-email-templates",[54],"email template guide","\nlists this under its limitations: \"Certain email providers may have spam\ndetection or other security features\" that \"prefetch URL links from incoming\nemails\". The example it gives is \"Safe Links in Microsoft Defender for Office\n365\". Supabase's\n",[50,109,112],{"href":110,"rel":111},"https:\u002F\u002Fsupabase.com\u002Fkb\u002Ftroubleshooting\u002Fotp-verification-failures-token-has-expired-or-otp_expired-errors",[54],"troubleshooting page for this error","\ncalls email prefetching \"the most common reason for OTP tokens appearing\nexpired or invalid before a user can even use them.\"",[10,115,116],{},"The default link has no step between opening and using. Its address is your\nproject's verify endpoint, which checks the token and spends it on the first\nvisit, whoever makes it. So the filter hands the ticket in as the message\narrives, and it goes through. Your user clicks a minute later and is turned\naway at the door.",[118,119],"diagram",{"alt":120,"caption":121,"src":122},"One email with a ticket inside. Two paths leave it for the same door. The first, from a magnifying glass standing for the mail filter, reaches the door within moments and gets a tick. The second, from the person, arrives later and gets a red cross, because the ticket now has a hole punched in it.","The first visit uses the link. A mail filter that opens it to check it gets there before the person does.","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fwho-used-it-first-1600x720.png",[10,124,125],{},"Two things follow from that.",[127,128,129,136],"ul",{},[130,131,132,135],"li",{},[34,133,134],{},"You will not see it yourself."," It happens to people whose mail passes\nthrough a filter of that kind, which may never include your own inbox. Your\ntest sign-ups keep working while your users write in.",[130,137,138,141],{},[34,139,140],{},"The account is usually confirmed already."," For a sign-up confirmation, the\nfilter's visit counts: Supabase confirms the address of whoever opens the\nlink. When a filter opened it, the account is confirmed by the time your user\nsees the error, and they can sign in with the password they chose.",[39,143,145],{"id":144},"the-other-three-causes","The other three causes",[10,147,148],{},"Each of these produces the same message, and each one needs something\ndifferent from you.",[10,150,151,154,155,160],{},[34,152,153],{},"The link was used already."," Your user pressed it once, perhaps on their\nphone, and is now pressing the same email on their laptop. When a link works,\nSupabase clears every link still waiting for that account. Its\n",[50,156,159],{"href":157,"rel":158},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Fmodels\u002Fuser.go",[54],"account code","\nruns the same cleanup after a confirmation and after a sign-in link, so a\nsecond press finds nothing. The ticket was punched on the first visit.",[10,162,163,166,167,172,173,177],{},[34,164,165],{},"A newer email replaced it."," Pressing \"send again\" creates a new link, and\nSupabase deletes the older one of the same kind before saving it. That happens\nin\n",[50,168,171],{"href":169,"rel":170},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Fmodels\u002Fone_time_token.go",[54],"the code that creates the token",".\nThe first email still sits in the inbox looking fine, and its link fails. Only\nthe newest email works. Supabase also lets one address ask for this kind of\nemail only once every 60 seconds, which\n",[50,174,176],{"href":175},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","the email rate limit"," covers in\nfull.",[10,179,180,183,184,189],{},[34,181,182],{},"It really did expire."," Supabase's\n",[50,185,188],{"href":186,"rel":187},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fauth-email-passwordless",[54],"passwordless guide","\nsays magic links \"expire after 1 hour\" by default. The same page says the\nEmail OTP Expiration setting \"also governs the validity of Magic Links and\nother email links, including confirmation, password recovery, email change,\nand invitation links.\" Somebody who signs up in the evening and opens the email\nthe next morning meets this message, whatever their mail service does.",[39,191,193],{"id":192},"what-happens-when-the-link-is-opened-on-another-device","What happens when the link is opened on another device?",[10,195,196],{},"If your app uses the PKCE flow, the other device fails with a different\nmessage first, and this one follows.",[10,198,199,200,205],{},"PKCE splits the ticket in two. Supabase's\n",[50,201,204],{"href":202,"rel":203},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fsessions\u002Fpkce-flow",[54],"PKCE guide"," says\n\"the code verifier is created and stored locally when the Auth flow is first\ninitiated\", and so \"the code exchange must be initiated on the same browser and\ndevice where the flow was started.\" The email carries one half. The browser\nwhere your user asked for the link keeps the stub.",[10,207,208],{},"Opened on a phone, the link still goes through Supabase's check, which uses it.\nThen your app looks for the stub on the phone and finds none. Supabase's\nJavaScript client reports that in its own words:",[14,210,213],{"className":211,"code":212,"language":19},[17],"PKCE code verifier not found in storage. This can happen if the auth flow was initiated in a different browser or device, or if the storage was cleared.\n",[21,214,212],{"__ignoreMap":23},[10,216,217,218,221],{},"So the person goes back to the laptop and presses the same email there, and\nSupabase answers \"Email link is invalid or has expired\", because the phone\nalready had the ticket punched. If the address your app opens on after a\nworking link contains ",[21,219,220],{},"?code=",", your app uses PKCE and this case applies to\nyou.",[39,223,225],{"id":224},"how-do-i-tell-which-one-it-was","How do I tell which one it was?",[10,227,228,229,232],{},"Ask your own database. Every account in your project is a row in a table called\n",[21,230,231],{},"auth.users",", and that row records when each kind of email was sent and when\nthe address was confirmed.",[10,234,235,236,239],{},"Open the ",[34,237,238],{},"SQL Editor"," in your Supabase dashboard and run this with the\naddress the person gave you:",[14,241,244],{"className":242,"code":243,"language":19},[17],"select email,\n       confirmation_sent_at,\n       email_confirmed_at,\n       recovery_sent_at\nfrom auth.users\nwhere lower(email) = lower('person@example.com');\n",[21,245,243],{"__ignoreMap":23},[10,247,248,249,252,253,256],{},"It reads one row and changes nothing. ",[21,250,251],{},"confirmation_sent_at"," is when the last\nsign-up confirmation went out. ",[21,254,255],{},"recovery_sent_at"," is when the last magic link\nor password reset went to an account that already existed. Those are the\ntimes Supabase measures the hour from, in the same function that returns the\nerror. Compare them with the time on the email the person pressed.",[258,259,260,273],"table",{},[261,262,263],"thead",{},[264,265,266,270],"tr",{},[267,268,269],"th",{},"What you see",[267,271,272],{},"What it means",[274,275,276,289,300,313],"tbody",{},[264,277,278,286],{},[279,280,281,282,285],"td",{},"A confirmation link failed on its first press, and ",[21,283,284],{},"email_confirmed_at"," is filled in",[279,287,288],{},"Something opened the link before the person did. The account is confirmed, so they can sign in with their password",[264,290,291,297],{},[279,292,293,294,296],{},"A confirmation link failed, ",[21,295,284],{}," is empty, and they pressed it over an hour after it was sent",[279,298,299],{},"It expired. Send a new confirmation",[264,301,302,310],{},[279,303,304,306,307,309],{},[21,305,251],{}," or ",[21,308,255],{}," is later than the email they pressed",[279,311,312],{},"A newer email replaced it. The newest one is the only link that works",[264,314,315,318],{},[279,316,317],{},"A magic link from the newest email failed on its first press, within the hour",[279,319,320],{},"Something opened it first: a mail filter, or the person on another device",[10,322,323,324,328],{},"If the row shows the address confirmed and the person still cannot get in with\na password, ",[50,325,327],{"href":326},"\u002Fblog\u002Fsupabase-invalid-login","Invalid login credentials"," is the\nnext message to read about.",[39,330,332],{"id":331},"what-not-to-change-while-you-fix-it","What not to change while you fix it",[10,334,335],{},"The expiry, the Confirm email switch, and who is allowed to confirm a user.\nEach of the obvious shortcuts here makes the message stop and opens something.",[10,337,338,341],{},[34,339,340],{},"Leave the expiry at an hour."," A filter opens the link as the message\narrives, so a link that lasts a week still gets used first. Supabase's\npasswordless guide says \"An expiry duration of more than 86,400 seconds (one\nday) is strongly discouraged\". A sign-in link signs in whoever opens it. The\nlonger it keeps working, the longer a forwarded email, a shared inbox or an old\nmessage in somebody's archive is a way into that account.",[10,343,344,347],{},[34,345,346],{},"Leave Confirm email on."," Switching it off means sign-ups send no link at all,\nso this error stops. It also means anybody can create an account with an\naddress they have never controlled.",[10,349,350,353,354,357,358,363,364,367,368,371,372,374,375,379,380,84],{},[34,351,352],{},"Do not confirm users from the browser."," Ask an assistant to \"just mark them\nas confirmed\" and it may reach for Supabase's admin functions, which can set\n",[21,355,356],{},"email_confirm"," on an account. Supabase's\n",[50,359,362],{"href":360,"rel":361},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Freference\u002Fjavascript\u002Fadmin-api",[54],"admin reference","\nsays \"Any method under the ",[21,365,366],{},"supabase.auth.admin"," namespace requires a ",[21,369,370],{},"secret","\nkey\" and \"Never expose your ",[21,373,370],{}," key in the browser.\" A secret key in your\nfrontend reads and writes every table in your database, whatever your rules\nsay, for anyone who opens your site's code. That is the key\n",[50,376,378],{"href":377},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","this article on API keys","\ntells you to rotate. If you are not sure one has slipped in, our free scan\nreads the code your live app sends to every visitor and flags the secret keys\nit finds there. It takes about 20 seconds and needs no account:\n",[50,381,383],{"href":382},"\u002Fsecurity-scanner","scan your app",[10,385,386,389],{},[34,387,388],{},"Check any address your confirm page passes on."," Supabase's second suggested\nfix is a page of your own with a button, reached through a link of this shape:",[14,391,394],{"className":392,"code":393,"language":19},[17],"\u003Ca href=\"{{ .SiteURL }}\u002Fconfirm-signup?confirmation_url={{ .ConfirmationURL }}\">\n",[21,395,393],{"__ignoreMap":23},[10,397,398,399,402,403,406],{},"The button then goes wherever ",[21,400,401],{},"confirmation_url"," says. Built without a check,\nthat page will send anybody who follows a crafted link to any address at all,\nunder your app's name. Either check that the address starts with your own\nproject's ",[21,404,405],{},"https:\u002F\u002F\u003Cproject-ref>.supabase.co\u002Fauth\u002Fv1\u002Fverify",", or use the token\nversion in the next section, which passes no address through the page.",[39,408,410],{"id":409},"how-to-send-a-link-a-mail-filter-cannot-use-up","How to send a link a mail filter cannot use up",[10,412,413],{},"Make opening the address do nothing, so that only a person typing a code or\npressing a button signs in. Supabase documents both, and you change them in the\nemail templates under Authentication in your dashboard. Confirm signup and\nMagic Link are the two to edit.",[10,415,416,419,420,423],{},[34,417,418],{},"Send a code."," Put ",[21,421,422],{},"{{ .Token }}"," in the template. Supabase's guide describes\nit as \"a 6-digit One-Time-Password (OTP) that can be used instead of\" the link.\nYour page asks for the email address and the code, then calls:",[14,425,428],{"className":426,"code":427,"language":19},[17],"const { error } = await supabase.auth.verifyOtp({ email, token, type: 'email' })\n",[21,429,427],{"__ignoreMap":23},[10,431,432],{},"A filter can open an email. It cannot type a code into your page.",[10,434,435,438],{},[34,436,437],{},"Link to a page with a button."," Point the link at a page of yours and carry\nthe token's hash, so no address has to pass through:",[14,440,443],{"className":441,"code":442,"language":19},[17],"\u003Ca href=\"{{ .SiteURL }}\u002Fconfirm?token_hash={{ .TokenHash }}&type=email\">Confirm your email\u003C\u002Fa>\n",[21,444,442],{"__ignoreMap":23},[10,446,447,450,451,454,455,84],{},[21,448,449],{},"{{ .SiteURL }}"," is the Site URL on your project's URL Configuration page. If\nit still says ",[21,452,453],{},"http:\u002F\u002Flocalhost:3000",",\n",[50,456,458],{"href":457},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","fix that first",[10,460,461],{},"The page shows one button, and only the button does the work:",[14,463,466],{"className":464,"code":465,"language":19},[17],"const params = new URLSearchParams(window.location.search)\n\nasync function onConfirmClick() {\n  const { error } = await supabase.auth.verifyOtp({\n    token_hash: params.get('token_hash'),\n    type: 'email',\n  })\n  if (error?.code === 'otp_expired') showSendNewLink()\n}\n",[21,467,465],{"__ignoreMap":23},[10,469,470,471,474],{},"The type ",[21,472,473],{},"email"," covers both templates: Supabase's check looks the hash up\namong sign-up confirmations and sign-in links alike.",[10,476,477,183,484,489,490,493],{},[34,478,479,480,483],{},"The page must not call ",[21,481,482],{},"verifyOtp"," when it loads.",[50,485,488],{"href":486,"rel":487},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fpasswords",[54],"password guide"," builds its\nconfirmation link as\n",[21,491,492],{},"{{ .SiteURL }}\u002Fauth\u002Fconfirm?token_hash={{ .TokenHash }}&type=email&next={{ .RedirectTo }}","\nand verifies it the moment that address is opened. That is the default link\nagain at a new address, and a filter opens it just as easily.",[118,495],{"alt":496,"caption":497,"src":498},"Two emails side by side. On the left, the link goes straight to the door: the magnifying glass opens it first, gets a tick, and the person behind it gets a red cross. On the right, the link opens a page with a button: the magnifying glass opens the page and nothing happens, the ticket stays whole, and the person presses the button and gets the tick.","With the default link, opening it signs in. With a button or a typed code, only the person's action does.","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fopening-is-not-using-1600x760.png",[10,500,501],{},"Whatever you change, some people will still meet an old link, so give them a\nway forward. The page your links land on can read the error and offer a new\nemail:",[14,503,506],{"className":504,"code":505,"language":19},[17],"const hash = new URLSearchParams(window.location.hash.slice(1))\nif (hash.get('error_code') === 'otp_expired') showSendNewLink()\n",[21,507,505],{"__ignoreMap":23},[10,509,510,511,513],{},"For a sign-up, add a line saying they may already be confirmed and can try\nsigning in. If a builder writes your sign-in pages, ask it for the code or\nbutton version of both templates, a landing page that reads ",[21,512,59],{}," and\noffers a fresh link, and no admin key anywhere in the app.",[39,515,517],{"id":516},"hearing-about-trouble-before-your-users-write-in","Hearing about trouble before your users write in",[10,519,520],{},"This error reaches your users and never you, and other failures reach them\nfirst too: the app going down at night, or a later prompt shipping a key in\nyour app's code.",[10,522,523],{},[34,524,525,529],{},[50,526,528],{"href":527},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking your live app from outside:",[127,531,532,535,538,541],{},[130,533,534],{},"whether it is up, every 60 seconds, so \"the link does not work\" can be told apart from \"the site is down\"",[130,536,537],{},"all nine checks every hour, on up to three apps, including secret keys in the code your app sends to visitors",[130,539,540],{},"a message when a result changes, so a key that ships in a later deploy reaches you without you going to look",[130,542,543],{},"a monthly report, in plain language, of what it saw",[10,545,546],{},[34,547,548,552],{},[50,549,551],{"href":550},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database,\naccounts included:",[127,554,555,558,561,564,567,570],{},[130,556,557],{},"an encrypted copy on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[130,559,560],{},"the auth schema your users' accounts live in, so they come back with everything else",[130,562,563],{},"each copy verified before it counts, by counting the rows in every table",[130,565,566],{},"your uploaded files as well, once you connect a Storage credential",[130,568,569],{},"a one-click restore, with a safety copy of the current state taken first",[130,571,572],{},"everything Monitor does",[39,574,576],{"id":575},"what-to-do-now","What to do now",[578,579,580],"key-takeaways",{},[127,581,582,591,594,599,605],{},[130,583,584,585,587,588,590],{},"Read the person's row in ",[21,586,231],{},". A filled ",[21,589,284],{}," on a failed confirmation means a filter opened the link and they can sign in.",[130,592,593],{},"Tell people to use the newest email, and if your app uses PKCE, to open it on the device where they asked for it.",[130,595,596,597,84],{},"Change the Confirm signup and Magic Link templates to send a code, or to open a page where a button calls ",[21,598,482],{},[130,600,601,602,604],{},"Make the page your links land on read ",[21,603,74],{}," and offer a new link.",[130,606,607],{},"Leave the expiry at an hour, leave Confirm email on, and keep the secret key out of the browser.",[10,609,610,611,613,614,618],{},"If the emails are not arriving at all, ",[50,612,176],{"href":175},"\nis the first thing to rule out. The\n",[50,615,617],{"href":616},"\u002Fchecklist","10-minute security checklist"," covers what else tends to be left\nopen in a newly launched app.",{"title":23,"searchDepth":620,"depth":620,"links":621},3,[622,624,625,626,627,628,629,630,631],{"id":41,"depth":623,"text":42},2,{"id":94,"depth":623,"text":95},{"id":144,"depth":623,"text":145},{"id":192,"depth":623,"text":193},{"id":224,"depth":623,"text":225},{"id":331,"depth":623,"text":332},{"id":409,"depth":623,"text":410},{"id":516,"depth":623,"text":517},{"id":575,"depth":623,"text":576},"Security basics","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcover-1200x630.png","An open envelope with a ticket half out of it, and the ticket already has a hole punched through it.","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.",false,"md",[639,642,645,648,651,654],{"q":640,"a":641},"Why does a Supabase magic link say it has expired right after I sent it?","Usually because something opened it before the person did. Some email services open the links in an incoming message to check them, and Supabase names Safe Links in Microsoft Defender for Office 365 as an example. Opening a Supabase email link uses it, so when the person clicks a minute later the token is gone and Supabase answers \"Email link is invalid or has expired\".",{"q":643,"a":644},"Is the account confirmed even though the link said it had expired?","If a mail filter opened a sign-up confirmation link first, yes. Supabase confirms the address for whoever opens the link, so the filter's visit confirmed it. Look at email_confirmed_at in auth.users: if it is filled in, the person can sign in with the password they chose.",{"q":646,"a":647},"How long does a Supabase email link stay valid?","One hour by default. The Email OTP expiration setting controls it, and the same setting covers magic links, sign-up confirmations, password resets, email changes and invitations. Supabase strongly discourages anything over 86,400 seconds, which is one day.",{"q":649,"a":650},"Should I make the links last longer?","No. A mail filter opens the link when the message arrives, so a longer life does not stop it being used first. What it does is keep every unused link in every inbox working for longer, and a link signs in whoever opens it, including somebody the email was forwarded to.",{"q":652,"a":653},"Why does the link work on my computer and fail on my phone?","If your app uses the PKCE flow, the browser where the person asked for the link keeps half of what the sign-in needs, so opening the email on another device fails with \"PKCE code verifier not found in storage\". That attempt also uses the link up, which is why clicking it again on the first device then says \"Email link is invalid or has expired\".",{"q":655,"a":656},"What does error_code=otp_expired in my app's address mean?","It is how Supabase Auth reports a failed email link. It sends the person on to your app with error=access_denied, error_code=otp_expired and the message in the part of the address after the # sign. Your app can read error_code there and show a page that offers to send a new link.","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",[659,660,661,662,663,664,74],"email link is invalid or has expired supabase","email link is invalid or has expired","otp_expired supabase","supabase magic link expired immediately","supabase confirmation link not working","outlook safe links magic link",{},true,"\"Email link is invalid or has expired\" in Supabase","\u002Fblog\u002Femail-link-is-invalid-or-has-expired","2026-11-01",{"title":5,"description":635},"blog\u002Femail-link-is-invalid-or-has-expired",[673,674,675],"Supabase shows \"Email link is invalid or has expired\" when the token in a sign-in or confirmation link has already been used, has been replaced by a newer email, or is more than an hour old. The error code is otp_expired.","On a link the person received a minute ago, the usual cause is a mail filter that opened the link to check it and used it up doing so. Supabase's own troubleshooting page calls this the most common reason.","A longer expiry changes nothing. Change the email so that opening the address does nothing: send a code to type, or link to a page where a button signs the person in.","2p1F5YV2TlLZLVxywpohTGwNjKdXP2u71a7GF0T5zYI",[678,684,690,696,702,707,713,719,724,725,731,738,744,749,755,761,767,773,779,785,791,796,801,807,813,819,825,831,837,843,849,855,861,867,873,879,885,891,897,903,909,915,921,927,933,939,944,950,956,962,968,974,980,986,992,998,1004,1010,1016,1022,1028,1034,1040,1046,1052,1058,1064,1070,1076,1082,1088,1094,1100,1106,1112,1118,1124,1130,1136,1142,1148,1154,1160,1166,1171,1177,1183,1189,1194,1200],{"path":679,"title":680,"description":681,"published":682,"category":632,"image":683,"draft":636},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":685,"title":686,"description":687,"published":688,"category":632,"image":689,"draft":636},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":691,"title":692,"description":693,"published":694,"category":632,"image":695,"draft":636},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":697,"title":698,"description":699,"published":700,"category":632,"image":701,"draft":636},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":82,"title":703,"description":704,"published":705,"category":632,"image":706,"draft":636},"Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":708,"title":709,"description":710,"published":711,"category":632,"image":712,"draft":636},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":714,"title":715,"description":716,"published":717,"category":632,"image":718,"draft":636},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":457,"title":720,"description":721,"published":722,"category":632,"image":723,"draft":636},"Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":668,"title":5,"description":635,"published":669,"category":632,"image":657,"draft":636},{"path":726,"title":727,"description":728,"published":729,"category":632,"image":730,"draft":636},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":732,"title":733,"description":734,"published":735,"category":736,"image":737,"draft":636},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":739,"title":740,"description":741,"published":742,"category":632,"image":743,"draft":636},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":326,"title":745,"description":746,"published":747,"category":632,"image":748,"draft":636},"\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":750,"title":751,"description":752,"published":753,"category":632,"image":754,"draft":636},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":756,"title":757,"description":758,"published":759,"category":632,"image":760,"draft":636},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":762,"title":763,"description":764,"published":765,"category":632,"image":766,"draft":636},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":768,"title":769,"description":770,"published":771,"category":632,"image":772,"draft":636},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":774,"title":775,"description":776,"published":777,"category":632,"image":778,"draft":636},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":780,"title":781,"description":782,"published":783,"category":632,"image":784,"draft":636},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":786,"title":787,"description":788,"published":789,"category":632,"image":790,"draft":636},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":175,"title":792,"description":793,"published":794,"category":632,"image":795,"draft":636},"Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":90,"title":797,"description":798,"published":799,"category":632,"image":800,"draft":636},"Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":802,"title":803,"description":804,"published":805,"category":632,"image":806,"draft":636},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":808,"title":809,"description":810,"published":811,"category":632,"image":812,"draft":636},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":814,"title":815,"description":816,"published":817,"category":632,"image":818,"draft":636},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":820,"title":821,"description":822,"published":823,"category":632,"image":824,"draft":636},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":826,"title":827,"description":828,"published":829,"category":632,"image":830,"draft":636},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":832,"title":833,"description":834,"published":835,"category":632,"image":836,"draft":636},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":838,"title":839,"description":840,"published":841,"category":632,"image":842,"draft":636},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":844,"title":845,"description":846,"published":847,"category":632,"image":848,"draft":636},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":850,"title":851,"description":852,"published":853,"category":632,"image":854,"draft":636},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":856,"title":857,"description":858,"published":859,"category":632,"image":860,"draft":636},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":862,"title":863,"description":864,"published":865,"category":632,"image":866,"draft":636},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":868,"title":869,"description":870,"published":871,"category":632,"image":872,"draft":636},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":874,"title":875,"description":876,"published":877,"category":632,"image":878,"draft":636},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":880,"title":881,"description":882,"published":883,"category":632,"image":884,"draft":636},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":886,"title":887,"description":888,"published":889,"category":632,"image":890,"draft":636},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":892,"title":893,"description":894,"published":895,"category":632,"image":896,"draft":636},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":898,"title":899,"description":900,"published":901,"category":632,"image":902,"draft":636},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":904,"title":905,"description":906,"published":907,"category":632,"image":908,"draft":636},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":910,"title":911,"description":912,"published":913,"category":632,"image":914,"draft":636},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":916,"title":917,"description":918,"published":919,"category":632,"image":920,"draft":636},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":922,"title":923,"description":924,"published":925,"category":736,"image":926,"draft":636},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":928,"title":929,"description":930,"published":931,"category":736,"image":932,"draft":636},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":934,"title":935,"description":936,"published":937,"category":736,"image":938,"draft":636},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":940,"title":941,"description":942,"published":937,"category":632,"image":943,"draft":636},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":945,"title":946,"description":947,"published":948,"category":632,"image":949,"draft":636},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":951,"title":952,"description":953,"published":954,"category":632,"image":955,"draft":636},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":957,"title":958,"description":959,"published":960,"category":736,"image":961,"draft":636},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":963,"title":964,"description":965,"published":966,"category":632,"image":967,"draft":636},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":969,"title":970,"description":971,"published":972,"category":632,"image":973,"draft":636},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":975,"title":976,"description":977,"published":978,"category":632,"image":979,"draft":636},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":981,"title":982,"description":983,"published":984,"category":632,"image":985,"draft":636},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":987,"title":988,"description":989,"published":990,"category":632,"image":991,"draft":636},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":993,"title":994,"description":995,"published":996,"category":632,"image":997,"draft":636},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":999,"title":1000,"description":1001,"published":1002,"category":632,"image":1003,"draft":636},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1005,"title":1006,"description":1007,"published":1008,"category":632,"image":1009,"draft":636},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1011,"title":1012,"description":1013,"published":1014,"category":736,"image":1015,"draft":636},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1017,"title":1018,"description":1019,"published":1020,"category":736,"image":1021,"draft":636},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1023,"title":1024,"description":1025,"published":1026,"category":736,"image":1027,"draft":636},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1029,"title":1030,"description":1031,"published":1032,"category":632,"image":1033,"draft":636},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":1035,"title":1036,"description":1037,"published":1038,"category":632,"image":1039,"draft":636},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1041,"title":1042,"description":1043,"published":1044,"category":632,"image":1045,"draft":636},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1047,"title":1048,"description":1049,"published":1050,"category":632,"image":1051,"draft":636},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1053,"title":1054,"description":1055,"published":1056,"category":632,"image":1057,"draft":636},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1059,"title":1060,"description":1061,"published":1062,"category":632,"image":1063,"draft":636},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1065,"title":1066,"description":1067,"published":1068,"category":632,"image":1069,"draft":636},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1071,"title":1072,"description":1073,"published":1074,"category":632,"image":1075,"draft":636},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1077,"title":1078,"description":1079,"published":1080,"category":632,"image":1081,"draft":636},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1083,"title":1084,"description":1085,"published":1086,"category":632,"image":1087,"draft":636},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1089,"title":1090,"description":1091,"published":1092,"category":736,"image":1093,"draft":636},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1095,"title":1096,"description":1097,"published":1098,"category":632,"image":1099,"draft":636},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1101,"title":1102,"description":1103,"published":1104,"category":736,"image":1105,"draft":636},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1107,"title":1108,"description":1109,"published":1110,"category":632,"image":1111,"draft":636},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1113,"title":1114,"description":1115,"published":1116,"category":632,"image":1117,"draft":636},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1119,"title":1120,"description":1121,"published":1122,"category":632,"image":1123,"draft":636},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1125,"title":1126,"description":1127,"published":1128,"category":632,"image":1129,"draft":636},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1131,"title":1132,"description":1133,"published":1134,"category":736,"image":1135,"draft":636},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1137,"title":1138,"description":1139,"published":1140,"category":736,"image":1141,"draft":636},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1143,"title":1144,"description":1145,"published":1146,"category":632,"image":1147,"draft":636},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1149,"title":1150,"description":1151,"published":1152,"category":632,"image":1153,"draft":636},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1155,"title":1156,"description":1157,"published":1158,"category":736,"image":1159,"draft":636},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1161,"title":1162,"description":1163,"published":1164,"category":632,"image":1165,"draft":636},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1167,"title":1168,"description":1169,"published":1164,"category":632,"image":1170,"draft":636},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1172,"title":1173,"description":1174,"published":1175,"category":632,"image":1176,"draft":636},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1178,"title":1179,"description":1180,"published":1181,"category":736,"image":1182,"draft":636},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1184,"title":1185,"description":1186,"published":1187,"category":632,"image":1188,"draft":636},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1190,"title":1191,"description":1192,"published":1187,"category":736,"image":1193,"draft":636},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1195,"title":1196,"description":1197,"published":1198,"category":736,"image":1199,"draft":636},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":377,"title":1201,"description":1202,"published":1198,"category":632,"image":1203,"draft":636},"Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]