[{"data":1,"prerenderedAt":1132},["ShallowReactive",2],{"blog-en-failed-to-send-a-request-to-the-edge-function":3,"blog-index-en":603},{"id":4,"title":5,"body":6,"category":559,"cover":560,"coverAlt":561,"description":562,"draft":563,"extension":564,"faq":565,"image":583,"keywords":584,"meta":591,"navigation":592,"ogTitle":593,"path":594,"published":595,"seo":596,"stem":597,"tldr":598,"updated":595,"__hash__":602},"blog_en\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function.md","\"Failed to send a request to the Edge Function\" in Supabase",{"type":7,"value":8,"toc":548},"minimark",[9,13,24,27,35,40,43,65,68,83,95,99,102,114,121,127,136,153,159,163,166,254,273,282,288,307,326,330,333,352,361,369,376,379,391,397,402,406,409,419,427,430,445,449,455,464,479,489,506,510,533],[10,11,12],"p",{},"Your app has a button that calls a Supabase Edge Function, the small piece of\nserver code an app built with Lovable, Bolt, Cursor or Claude Code uses for work\nthat cannot happen in the browser, such as calling OpenAI with a key. You press\nit, and instead of a result your app shows this:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","Failed to send a request to the Edge Function\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26],{},"The function is deployed. Called from a terminal, it may even answer perfectly\nwell. From your app it fails every time, and \"failed to send a request to the\nEdge Function\" reads as if your request never left.",[10,28,29,30,34],{},"It may well have. ",[31,32,33],"strong",{},"Your function may have run, done its work and answered, and the\nbrowser declined to hand the answer to your app."," Which of the two happened is\nwritten down in one place, and it is not the error your app received.",[36,37,39],"h2",{"id":38},"what-does-failed-to-send-a-request-to-the-edge-function-mean","What does \"Failed to send a request to the Edge Function\" mean?",[10,41,42],{},"It means supabase-js asked for a reply and got none it was allowed to read.",[10,44,45,46,53,54,57,58,64],{},"The sentence is fixed text inside\n",[47,48,52],"a",{"href":49,"rel":50},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase-js\u002Fblob\u002Fmaster\u002Fpackages\u002Fcore\u002Ffunctions-js\u002Fsrc\u002Ftypes.ts",[51],"nofollow","supabase-js",",\nattached to an error called ",[21,55,56],{},"FunctionsFetchError",". supabase-js raises it when\nthe request itself fails, before there is any status code to look at. That is\nwhat separates it from its better-known sibling:\n",[47,59,61],{"href":60},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code",[21,62,63],{},"Edge Function returned a non-2xx status code","\nmeans a reply came back and it was an error. This one means no readable reply\ncame back at all.",[10,66,67],{},"A request fails that way for a handful of reasons. The device is offline, the\nproject address in your app is wrong, or the browser's cross-origin rules\nrefused the answer. Those rules are called CORS, short for Cross-Origin\nResource Sharing, and they stop a web page reading a reply from another address\nunless the reply says it may. When the function answers from a terminal and\nfails only in your app, CORS is the one to suspect, and the browser will tell\nyou whether it was.",[10,69,70,71,74,75,78,79,82],{},"Your app lives at one address, say ",[21,72,73],{},"yourapp.lovable.app",", and your function at\nanother, ",[21,76,77],{},"\u003Cproject-ref>.supabase.co",". Think of the browser as your app's\ndoorman. Post from another address is handed to your app\nonly if it carries a label from the sender saying your app may have it: a reply\nheader called ",[21,80,81],{},"Access-Control-Allow-Origin",". For a letter like yours, the\ndoorman first knocks on the sender's door to ask whether they accept it at all.\nAnd when he refuses something, he tells your app only that it failed. The\nreason goes in his own book.",[10,84,85,86,89,90,94],{},"A third message belongs to the same family. ",[21,87,88],{},"Relay Error invoking the Edge Function"," is supabase-js reporting that Supabase's relay could not reach your\nfunction, so ",[47,91,93],{"href":92},"\u002Fblog\u002Fis-supabase-down-or-your-app","check whether Supabase is having a problem","\nbefore you change any code.",[36,96,98],{"id":97},"why-your-app-is-told-nothing-more","Why your app is told nothing more",[10,100,101],{},"Because the browser keeps the reason from your code on purpose.",[10,103,104,109,110,113],{},[47,105,108],{"href":106,"rel":107},"https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FGuides\u002FCORS\u002FErrors",[51],"MDN's page on CORS errors","\nsays it plainly: \"For security reasons, specifics about what went wrong with a\nCORS request are not available to JavaScript code.\" Your app learns that\nsomething failed and nothing else. In Chrome the error supabase-js wraps reads\n",[21,111,112],{},"TypeError: Failed to fetch",", which Chromium uses for every network failure\nalike, so printing it adds nothing. The same MDN page says the only way to find\nout what went wrong is the browser's console.",[10,115,116,117,120],{},"That is the doorman's book. Open your live app in Chrome or Edge, press F12,\nchoose ",[31,118,119],{},"Console",", and press the button in your app again. The line you want\nis red and starts like this:",[14,122,125],{"className":123,"code":124,"language":19},[17],"Access to fetch at 'https:\u002F\u002F\u003Cproject-ref>.supabase.co\u002Ffunctions\u002Fv1\u002F\u003Cname>' from origin 'https:\u002F\u002Fyourapp.lovable.app' has been blocked by CORS policy:\n",[21,126,124],{"__ignoreMap":23},[10,128,129,130,135],{},"Everything after the colon is the reason. Firefox and Safari word it\ndifferently; the quotes in this post are Chrome's, from\n",[47,131,134],{"href":132,"rel":133},"https:\u002F\u002Fgithub.com\u002Fchromium\u002Fchromium\u002Fblob\u002Fmain\u002Fthird_party\u002Fblink\u002Frenderer\u002Fplatform\u002Floader\u002Fcors\u002Fcors_error_string.cc",[51],"Chromium's own source",".",[10,137,138,139,142,143,146,147,152],{},"The knock has a technical name, the preflight request. It is a request with the\nmethod ",[21,140,141],{},"OPTIONS"," that the browser sends before yours, and supabase-js always\ntriggers one: it sends your key in an ",[21,144,145],{},"Authorization"," header and your data as\nJSON, and ",[47,148,151],{"href":149,"rel":150},"https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FHTTP\u002FGuides\u002FCORS",[51],"MDN's CORS guide","\nlists neither among the things a page may send without asking first.",[154,155],"diagram",{"alt":156,"caption":157,"src":158},"Two attempts at the same call. Above, the answer to the browser's OPTIONS knock comes back with an empty outline where its label should be, the browser refuses it, and the POST request never leaves. Below, the answer to the knock carries its label and passes, the POST reaches the function, which does its work, and the reply comes back without a label and is stopped at the browser's check.","Above, the knock is refused and your request never leaves. Below, the knock passes, the function does the work, and only its reply is held back.","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fthe-knock-first-1600x760.png",[36,160,162],{"id":161},"which-half-failed-and-did-your-function-run","Which half failed, and did your function run?",[10,164,165],{},"The words \"preflight request\" in the console line decide it. If they are\nthere, the browser stopped at the knock and your request was never sent. If\nthey are not, your request went through, your function ran, and its answer was\nheld back.",[167,168,169,185],"table",{},[170,171,172],"thead",{},[173,174,175,179,182],"tr",{},[176,177,178],"th",{},"The console line ends with",[176,180,181],{},"What happened",[176,183,184],{},"Did the function do the work?",[186,187,188,202,215,227,243],"tbody",{},[173,189,190,196,199],{},[191,192,193],"td",{},[21,194,195],{},"Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.",[191,197,198],{},"The knock was answered without the label",[191,200,201],{},"No. Only the knock reached it",[173,203,204,209,212],{},[191,205,206],{},[21,207,208],{},"Response to preflight request doesn't pass access control check: It does not have HTTP ok status.",[191,210,211],{},"The knock was answered with an error",[191,213,214],{},"No",[173,216,217,222,225],{},[191,218,219],{},[21,220,221],{},"Request header field \u003Cname> is not allowed by Access-Control-Allow-Headers in preflight response.",[191,223,224],{},"Your app sends a header the function's list does not name",[191,226,214],{},[173,228,229,235,238],{},[191,230,231,234],{},[21,232,233],{},"No 'Access-Control-Allow-Origin' header is present on the requested resource.",", with no mention of preflight",[191,236,237],{},"The knock passed, your request arrived, and the reply had no label",[191,239,240],{},[31,241,242],{},"Yes",[173,244,245,248,251],{},[191,246,247],{},"No CORS line at all",[191,249,250],{},"Not CORS: the connection, the address, or a timeout your code set",[191,252,253],{},"Check the Invocations tab",[10,255,256,262,263,268,269,272],{},[31,257,258,259,261],{},"The first row is what a function with no ",[21,260,141],{}," handler produces.","\nSupabase's\n",[47,264,267],{"href":265,"rel":266},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fedge-function-500-error-response",[51],"page on the 500 error","\ndescribes it from the function's side: the knock reaches your code like any\nother request, and the function logs ",[21,270,271],{},"SyntaxError: Unexpected end of JSON input",", because a knock carries no body and the code tried to read one. Its\nreply is an error with no headers on it, and Chrome reports the missing header\nbefore it looks at the status. If that line is in the function's Logs tab, you\nhave found it.",[10,274,275,278,279,281],{},[31,276,277],{},"The second row means the knock got the headers and an error with them."," One\nway to get there is a check placed above the ",[21,280,141],{}," branch that the knock\ncannot pass, such as a check on who is calling. The knock carries none of your\nheaders, your key included, so it fails that check every time.",[10,283,284,287],{},[31,285,286],{},"The fourth row is the one to slow down on, because the work happened."," If\nthe function saves a row, sends an email or charges a card, that is done, and\npressing the button again does it a second time. What failed is the reply,\nwhich went out without the label. Look first for an error: a crash, whose answer\nyour code never got as far as writing, or an error branch that returns without\nthe headers. Supabase's same page warns that this makes the browser blame CORS\nfor a failure whose real cause is something else.",[10,289,290,291,294,295,298,299,302,303,306],{},"So read the function's own record before you touch any headers. In the Supabase\ndashboard, open ",[31,292,293],{},"Edge Functions",", pick the function, and read its\n",[31,296,297],{},"Invocations"," and ",[31,300,301],{},"Logs"," tabs at the minute you pressed the button.\n",[47,304,305],{"href":60},"Reading the real error","\ngoes through both, and through what each status number means.",[10,308,309,312,313,316,317,320,321,325],{},[31,310,311],{},"The last row means the doorman refused nothing."," The request failed on its\nway: the device lost its connection, or the project address your app calls\ndoes not exist. One case comes from your own code. If it passes a ",[21,314,315],{},"timeout"," to\n",[21,318,319],{},"supabase.functions.invoke",",\n",[47,322,52],{"href":323,"rel":324},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase-js\u002Fblob\u002Fmaster\u002Fpackages\u002Fcore\u002Ffunctions-js\u002Fsrc\u002FFunctionsClient.ts",[51],"\ncancels the request when the time runs out and reports this same sentence, even\nthough the function may still be working.",[36,327,329],{"id":328},"how-to-fix-it-answer-the-knock-and-label-every-reply","How to fix it: answer the knock, and label every reply",[10,331,332],{},"Two changes in the function, and they belong in the same deploy.",[334,335,336,346],"ol",{},[337,338,339,345],"li",{},[31,340,341,342,344],{},"An ",[21,343,141],{}," branch as the very first thing",", before any line that reads\nthe body or checks who is calling. It answers the knock with the CORS\nheaders and nothing else.",[337,347,348,351],{},[31,349,350],{},"The CORS headers on every reply the function returns",", the successful\nones and the errors. A reply without them is held back, whatever it says.",[10,353,354,355,360],{},"Supabase's ",[47,356,359],{"href":357,"rel":358},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Fcors",[51],"CORS guide"," shapes\na function roughly like this:",[14,362,367],{"className":363,"code":365,"language":366,"meta":23},[364],"language-ts","import { corsHeaders } from 'npm:@supabase\u002Fsupabase-js@^2\u002Fcors'\n\nDeno.serve(async (req) => {\n  if (req.method === 'OPTIONS') {\n    return Response.json({ ok: true }, { headers: corsHeaders })\n  }\n  try {\n    const body = await req.json()\n    \u002F\u002F the function's own work goes here\n    return Response.json({ done: true }, { headers: corsHeaders })\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error)\n    return Response.json({ error: message }, { status: 400, headers: corsHeaders })\n  }\n})\n","ts",[21,368,365],{"__ignoreMap":23},[10,370,371,372,375],{},"The headers come from supabase-js itself rather than from a list pasted into\nthe function. The guide imports them this way from supabase-js version 2.95.0,\nso the list matches what the client libraries send, and it says to redeploy\nafter upgrading. Older functions carry a hand-written copy of the same list in\na file called ",[21,373,374],{},"_shared\u002Fcors.ts",". That copy is where the third row of the table\ncomes from: a header your app sends that the list does not name.",[10,377,378],{},"If you are asking Lovable, Bolt, Cursor or Claude Code to make the fix, those\ntwo numbered points are the prompt. Name both. The second is easy to leave out,\nand a function that has only the first moves from the first row of the table\nto the fourth the next time it crashes.",[10,380,381,382,385,386,390],{},"Supabase's newer examples wrap the whole function in ",[21,383,384],{},"withSupabase",", which\nanswers the knock for you. ",[47,387,389],{"href":388},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Moving a secret into an Edge Function","\nshows that wrapper with a check on who is calling, and that check is the\nsubject of the next section.",[10,392,393,394,396],{},"Once the headers are on every reply, a function that crashes stops showing this\nmessage and starts showing ",[21,395,63],{},". The\nreply now reaches your app, with the reason inside it.",[154,398],{"alt":399,"caption":400,"src":401},"One function sending three replies back toward the browser's check. A 200 reply with a label passes and reaches the app. A 500 reply without one is stopped at the check. A 400 reply with a label passes, so the app receives the error and can read it.","The browser looks for the label and never at what the reply says. An error that carries the headers reaches your app; one without them is held back and reported as a failed request.","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Ftag-every-reply-1600x720.png",[36,403,405],{"id":404},"does-the-cors-header-decide-who-can-call-your-function","Does the CORS header decide who can call your function?",[10,407,408],{},"No. It decides which web pages may read the answer, and only browsers ever\nlook at it.",[10,410,411,412,414,415,418],{},"Supabase's own list sets ",[21,413,81],{}," to ",[21,416,417],{},"*",", which allows\nevery origin, both in the copy supabase-js exports and in the older\nhand-written one. On a function that checks the caller's token, that is fine.\nOn a function that checks nothing, it lets any page on any website call your\nfunction from its own visitors' browsers and read what comes back.",[10,420,421,422,426],{},"Narrowing the header to your own domain does not close the function either. A\nscript, a terminal or another server sends the same request without a browser,\nnever reads the header, and gets the full answer.\n",[47,423,425],{"href":424},"\u002Fblog\u002Fcors-wildcard-security-risk","What a CORS wildcard does and does not open","\ngoes through that in detail.",[10,428,429],{},"The lock on an Edge Function is a check on who is calling, written into the\nfunction. It matters most on the functions that end up behind this error,\nbecause they are the ones holding an OpenAI key or your project's secret key,\nand the secret key gets past every row level security rule you wrote.",[10,431,432,433,436,437,440,441,135],{},"The other way out of a CORS error is to stop using the function: put the key in\na ",[21,434,435],{},"VITE_"," variable and call OpenAI straight from the page. It works at once, and\nit puts the key in the file every visitor downloads, which is the first of the\n",[47,438,439],{"href":60},"two fixes that leave you worse off",".\nYou can see that mistake from outside. Our free scan reads your live app's\nJavaScript the way a stranger would and names every key it finds, including\nwhether it is one that belongs there. It takes about 20 seconds and needs no\naccount: ",[47,442,444],{"href":443},"\u002Fsecurity-scanner","scan your app",[36,446,448],{"id":447},"keeping-the-key-out-of-the-page-after-the-next-change","Keeping the key out of the page after the next change",[10,450,451,454],{},[31,452,453],{},"A function you fixed today can be rewritten the next time you ask your\nbuilder for a feature",", and the quickest way past a CORS error is the one that\nputs your key in the page.",[10,456,457],{},[31,458,459,463],{},[47,460,462],{"href":461},"\u002Fwebsite-monitoring","Reeve Monitor"," re-scans your live app every hour:",[465,466,467,470,473,476],"ul",{},[337,468,469],{},"all nine checks every hour, on up to three apps",[337,471,472],{},"an email the day a re-scan grades your app lower than the one before; a secret key in your JavaScript caps the grade at D on its own",[337,474,475],{},"whether the app is up, every 60 seconds",[337,477,478],{},"a monthly report of what it saw",[10,480,481],{},[31,482,483,484,488],{},"A function holding your project's secret key can change any row in your\ndatabase for whoever calls it. ",[47,485,487],{"href":486},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of\nyour Supabase database where nothing in your project can reach it.",[465,490,491,494,497,500,503],{},[337,492,493],{},"an encrypted copy on a schedule, kept on Reeve's own storage in the EU, outside your Supabase account",[337,495,496],{},"each copy verified before it counts, by counting the rows in every table",[337,498,499],{},"a one-click restore that saves what is there now before it replaces anything",[337,501,502],{},"your uploaded files as well, once you connect a Storage credential",[337,504,505],{},"everything Monitor does",[36,507,509],{"id":508},"what-to-do-now","What to do now",[511,512,513],"key-takeaways",{},[465,514,515,518,524,527,530],{},[337,516,517],{},"Open your live app's browser console, press the button again, and read the end of the red CORS line.",[337,519,520,521,523],{},"If the line mentions the preflight request, add an ",[21,522,141],{}," branch at the very top of the function that returns the CORS headers.",[337,525,526],{},"If it does not, your function ran. Read its Invocations and Logs tabs, and check what it already did before anyone presses the button again.",[337,528,529],{},"Return the CORS headers on every reply, errors included, and import them from supabase-js 2.95.0 or later so the list stays current.",[337,531,532],{},"Keep a check on who is calling inside the function. The CORS header only tells browsers who may read the answer.",[10,534,535,536,538,539,542,543,547],{},"When the error in your app changes to ",[21,537,63],{},", the headers are working and the reply is getting through;\n",[47,540,541],{"href":60},"that post"," reads it from\nthere. The ",[47,544,546],{"href":545},"\u002Fchecklist","10-minute security checklist"," covers what else a newly\nlaunched app tends to leave open.",{"title":23,"searchDepth":549,"depth":549,"links":550},3,[551,553,554,555,556,557,558],{"id":38,"depth":552,"text":39},2,{"id":97,"depth":552,"text":98},{"id":161,"depth":552,"text":162},{"id":328,"depth":552,"text":329},{"id":404,"depth":552,"text":405},{"id":447,"depth":552,"text":448},{"id":508,"depth":552,"text":509},"Security basics","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcover-1200x630.png","A barrier arm lowered across the way, with an envelope held on the far side and an empty amber outline where its label should hang.","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.",false,"md",[566,568,571,574,577,580],{"q":39,"a":567},"It means supabase-js asked your Supabase Edge Function for a reply and got none it was allowed to read. The request either failed on its way, for example because the device was offline, or the browser refused to hand the answer to your app under its cross-origin rules, called CORS. The browser keeps the reason from your code on purpose and writes it in its console instead.",{"q":569,"a":570},"Why does my Edge Function work from a terminal but not from my app?","Because only browsers apply CORS. A terminal, a script or another server sends the request and reads the whole answer. A browser first checks that the answer says your app may read it, and before a request like the one supabase-js sends it also asks the function for permission with a separate OPTIONS request. If either step fails, your app gets this error while the same call works everywhere else.",{"q":572,"a":573},"Did my Edge Function run if I got this error?","Read the red line in the browser console. If it mentions the preflight request, the browser stopped at the permission check and your request was never sent. If it does not, the request went through, the function did its work, and only the reply was held back. In that case check the function's Invocations and Logs tabs before pressing the button again, because a second press repeats the work.",{"q":575,"a":576},"How do I fix a CORS error on a Supabase Edge Function?","Make the function answer the OPTIONS request first, before any code that reads the body or checks the caller, and return the CORS headers on every response, error responses included. Supabase's CORS guide imports those headers from supabase-js, version 2.95.0 or later, so the list matches what the client sends. Redeploy the function after the change.",{"q":578,"a":579},"What is \"Relay Error invoking the Edge Function\"?","It is a third message from supabase-js, raised when Supabase's relay could not reach your function. It is neither a CORS refusal nor a reply from your own code, so check whether Supabase itself is having a problem before you change anything.",{"q":581,"a":582},"Is it safe to allow every origin in my Edge Function's CORS headers?","Only if the function checks who is calling. The CORS header tells browsers which web pages may read the answer; it does not stop anyone calling the function. Supabase's own headers allow every origin, which is fine for a function that checks the caller's token and lets any website use one that does not. Narrowing it to your domain does not close the function to scripts either.","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",[585,56,586,587,588,589,590],"failed to send a request to the edge function","supabase edge function cors error","supabase edge function blocked by cors policy","response to preflight request doesn't pass access control check","relay error invoking the edge function","lovable edge function cors",{},true,"\"Failed to send a request to the Edge Function\"","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","2026-11-03",{"title":5,"description":562},"blog\u002Ffailed-to-send-a-request-to-the-edge-function",[599,600,601],"\"Failed to send a request to the Edge Function\" means supabase-js got no reply it was allowed to read. Either the request failed on the way, or the browser held the answer back, and your app is told nothing more on purpose.","The browser console has the reason. A line that mentions the preflight request means your request was never sent. A line that does not means your function ran and its reply was held back.","The fix is an OPTIONS branch at the top of the function and CORS headers on every reply, errors included. Those headers only tell browsers who may read the answer; a check in your code decides who may call.","GoxWqyvinU194bFZipqWvOMopJSMCFbZkSFQHM75Pek",[604,610,616,622,628,634,640,641,647,653,659,666,672,678,683,689,695,701,707,713,719,725,731,737,743,749,755,761,767,773,779,785,791,797,803,809,814,820,826,832,837,843,849,855,861,867,872,878,884,890,896,902,908,914,920,926,932,938,944,950,956,962,968,974,980,986,992,998,1004,1010,1016,1022,1028,1034,1040,1046,1052,1057,1063,1069,1075,1081,1087,1093,1098,1104,1110,1116,1121,1127],{"path":605,"title":606,"description":607,"published":608,"category":559,"image":609,"draft":563},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":611,"title":612,"description":613,"published":614,"category":559,"image":615,"draft":563},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":617,"title":618,"description":619,"published":620,"category":559,"image":621,"draft":563},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":623,"title":624,"description":625,"published":626,"category":559,"image":627,"draft":563},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":629,"title":630,"description":631,"published":632,"category":559,"image":633,"draft":563},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":635,"title":636,"description":637,"published":638,"category":559,"image":639,"draft":563},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":594,"title":5,"description":562,"published":595,"category":559,"image":583,"draft":563},{"path":642,"title":643,"description":644,"published":645,"category":559,"image":646,"draft":563},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":648,"title":649,"description":650,"published":651,"category":559,"image":652,"draft":563},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":654,"title":655,"description":656,"published":657,"category":559,"image":658,"draft":563},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":660,"title":661,"description":662,"published":663,"category":664,"image":665,"draft":563},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":667,"title":668,"description":669,"published":670,"category":559,"image":671,"draft":563},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":673,"title":674,"description":675,"published":676,"category":559,"image":677,"draft":563},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":60,"title":679,"description":680,"published":681,"category":559,"image":682,"draft":563},"\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":684,"title":685,"description":686,"published":687,"category":559,"image":688,"draft":563},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":690,"title":691,"description":692,"published":693,"category":559,"image":694,"draft":563},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":696,"title":697,"description":698,"published":699,"category":559,"image":700,"draft":563},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":702,"title":703,"description":704,"published":705,"category":559,"image":706,"draft":563},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":708,"title":709,"description":710,"published":711,"category":559,"image":712,"draft":563},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":714,"title":715,"description":716,"published":717,"category":559,"image":718,"draft":563},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":720,"title":721,"description":722,"published":723,"category":559,"image":724,"draft":563},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":726,"title":727,"description":728,"published":729,"category":559,"image":730,"draft":563},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":732,"title":733,"description":734,"published":735,"category":559,"image":736,"draft":563},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":738,"title":739,"description":740,"published":741,"category":559,"image":742,"draft":563},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":744,"title":745,"description":746,"published":747,"category":559,"image":748,"draft":563},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":750,"title":751,"description":752,"published":753,"category":559,"image":754,"draft":563},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":756,"title":757,"description":758,"published":759,"category":559,"image":760,"draft":563},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":762,"title":763,"description":764,"published":765,"category":559,"image":766,"draft":563},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":768,"title":769,"description":770,"published":771,"category":559,"image":772,"draft":563},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":774,"title":775,"description":776,"published":777,"category":559,"image":778,"draft":563},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":780,"title":781,"description":782,"published":783,"category":559,"image":784,"draft":563},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":786,"title":787,"description":788,"published":789,"category":559,"image":790,"draft":563},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":792,"title":793,"description":794,"published":795,"category":559,"image":796,"draft":563},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":798,"title":799,"description":800,"published":801,"category":559,"image":802,"draft":563},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":804,"title":805,"description":806,"published":807,"category":559,"image":808,"draft":563},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":388,"title":810,"description":811,"published":812,"category":559,"image":813,"draft":563},"Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":815,"title":816,"description":817,"published":818,"category":559,"image":819,"draft":563},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":821,"title":822,"description":823,"published":824,"category":559,"image":825,"draft":563},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":827,"title":828,"description":829,"published":830,"category":559,"image":831,"draft":563},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":92,"title":833,"description":834,"published":835,"category":559,"image":836,"draft":563},"Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":838,"title":839,"description":840,"published":841,"category":559,"image":842,"draft":563},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":844,"title":845,"description":846,"published":847,"category":559,"image":848,"draft":563},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":850,"title":851,"description":852,"published":853,"category":664,"image":854,"draft":563},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":856,"title":857,"description":858,"published":859,"category":664,"image":860,"draft":563},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":862,"title":863,"description":864,"published":865,"category":664,"image":866,"draft":563},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":868,"title":869,"description":870,"published":865,"category":559,"image":871,"draft":563},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":873,"title":874,"description":875,"published":876,"category":559,"image":877,"draft":563},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":879,"title":880,"description":881,"published":882,"category":559,"image":883,"draft":563},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":885,"title":886,"description":887,"published":888,"category":664,"image":889,"draft":563},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":891,"title":892,"description":893,"published":894,"category":559,"image":895,"draft":563},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":897,"title":898,"description":899,"published":900,"category":559,"image":901,"draft":563},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":903,"title":904,"description":905,"published":906,"category":559,"image":907,"draft":563},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":909,"title":910,"description":911,"published":912,"category":559,"image":913,"draft":563},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":915,"title":916,"description":917,"published":918,"category":559,"image":919,"draft":563},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":921,"title":922,"description":923,"published":924,"category":559,"image":925,"draft":563},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":927,"title":928,"description":929,"published":930,"category":559,"image":931,"draft":563},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":933,"title":934,"description":935,"published":936,"category":559,"image":937,"draft":563},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":939,"title":940,"description":941,"published":942,"category":664,"image":943,"draft":563},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":945,"title":946,"description":947,"published":948,"category":664,"image":949,"draft":563},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":951,"title":952,"description":953,"published":954,"category":664,"image":955,"draft":563},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":957,"title":958,"description":959,"published":960,"category":559,"image":961,"draft":563},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":963,"title":964,"description":965,"published":966,"category":559,"image":967,"draft":563},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":969,"title":970,"description":971,"published":972,"category":559,"image":973,"draft":563},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":975,"title":976,"description":977,"published":978,"category":559,"image":979,"draft":563},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":981,"title":982,"description":983,"published":984,"category":559,"image":985,"draft":563},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":987,"title":988,"description":989,"published":990,"category":559,"image":991,"draft":563},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":993,"title":994,"description":995,"published":996,"category":559,"image":997,"draft":563},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":999,"title":1000,"description":1001,"published":1002,"category":559,"image":1003,"draft":563},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1005,"title":1006,"description":1007,"published":1008,"category":559,"image":1009,"draft":563},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1011,"title":1012,"description":1013,"published":1014,"category":559,"image":1015,"draft":563},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1017,"title":1018,"description":1019,"published":1020,"category":664,"image":1021,"draft":563},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1023,"title":1024,"description":1025,"published":1026,"category":559,"image":1027,"draft":563},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1029,"title":1030,"description":1031,"published":1032,"category":664,"image":1033,"draft":563},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1035,"title":1036,"description":1037,"published":1038,"category":559,"image":1039,"draft":563},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1041,"title":1042,"description":1043,"published":1044,"category":559,"image":1045,"draft":563},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1047,"title":1048,"description":1049,"published":1050,"category":559,"image":1051,"draft":563},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":424,"title":1053,"description":1054,"published":1055,"category":559,"image":1056,"draft":563},"Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1058,"title":1059,"description":1060,"published":1061,"category":664,"image":1062,"draft":563},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1064,"title":1065,"description":1066,"published":1067,"category":664,"image":1068,"draft":563},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1070,"title":1071,"description":1072,"published":1073,"category":559,"image":1074,"draft":563},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1076,"title":1077,"description":1078,"published":1079,"category":559,"image":1080,"draft":563},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1082,"title":1083,"description":1084,"published":1085,"category":664,"image":1086,"draft":563},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1088,"title":1089,"description":1090,"published":1091,"category":559,"image":1092,"draft":563},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1094,"title":1095,"description":1096,"published":1091,"category":559,"image":1097,"draft":563},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1099,"title":1100,"description":1101,"published":1102,"category":559,"image":1103,"draft":563},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1105,"title":1106,"description":1107,"published":1108,"category":664,"image":1109,"draft":563},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1111,"title":1112,"description":1113,"published":1114,"category":559,"image":1115,"draft":563},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1117,"title":1118,"description":1119,"published":1114,"category":664,"image":1120,"draft":563},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1122,"title":1123,"description":1124,"published":1125,"category":664,"image":1126,"draft":563},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1128,"title":1129,"description":1130,"published":1125,"category":559,"image":1131,"draft":563},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]