[{"data":1,"prerenderedAt":1280},["ShallowReactive",2],{"blog-en-invalid-claim-missing-sub-claim":3,"blog-index-en":755},{"id":4,"title":5,"body":6,"category":713,"cover":714,"coverAlt":715,"description":716,"draft":717,"extension":718,"faq":719,"image":735,"keywords":736,"meta":743,"navigation":744,"ogTitle":745,"path":746,"published":747,"seo":748,"stem":749,"tldr":750,"updated":747,"__hash__":754},"blog_en\u002Fblog\u002Finvalid-claim-missing-sub-claim.md","Supabase \"invalid claim: missing sub claim\": nobody is signed in",{"type":7,"value":8,"toc":700},"minimark",[9,13,24,36,41,44,59,77,83,86,97,103,107,110,119,129,135,142,148,175,183,187,190,204,212,220,227,237,261,266,270,273,284,333,345,348,352,355,364,370,386,392,406,410,413,431,438,448,452,455,570,589,593,599,608,622,632,649,653,685],[10,11,12],"p",{},"Your app has a Supabase Edge Function that does something for the person using\nit, such as saving their settings or calling OpenAI on their behalf. It worked\nwhile you were testing it. Then the function's log starts filling with\nthis, and the app shows an error or nothing at all:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","AuthApiError: invalid claim: missing sub claim\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26,27,30,31,35],{},"Search \"invalid claim: missing sub claim\" and you will be told to regenerate\nyour keys, to switch off Verify JWT, or to put the ",[21,28,29],{},"service_role"," key in. Each\nof those treats the token as broken. ",[32,33,34],"strong",{},"The token was fine."," Supabase checked\nits signature and accepted it. What it lacked was anybody's name.",[37,38,40],"h2",{"id":39},"what-does-invalid-claim-missing-sub-claim-mean","What does \"invalid claim: missing sub claim\" mean?",[10,42,43],{},"Supabase Auth was asked which user is calling, found the token genuine, and\nfound no user written in it.",[10,45,46,47,50,51,58],{},"The tokens Supabase Auth reads are JWTs: three chunks of text separated by\ndots, where the middle chunk is readable data. Each item in that data is called a\nclaim. ",[21,48,49],{},"sub",", short for subject, is the claim that holds a user's id, and\nSupabase's ",[52,53,57],"a",{"href":54,"rel":55},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fjwt-fields",[56],"nofollow","JWT reference","\ndescribes it as the user ID, a UUID.",[10,60,61,62,65,66,69,70,72,73,76],{},"The message is written in Supabase Auth's own source, in a function called\n",[21,63,64],{},"maybeLoadUserOrSession"," in ",[21,67,68],{},"internal\u002Fapi\u002Fauth.go",". By the time that function\nruns, the token's signature has already been checked and has passed. It then\nlooks for ",[21,71,49],{},", and when the claim is empty it stops with HTTP 403, the error\ncode ",[21,74,75],{},"bad_jwt",", and this sentence. The reply your code receives looks like\nthis:",[14,78,81],{"className":79,"code":80,"language":19},[17],"{\"code\":403,\"error_code\":\"bad_jwt\",\"msg\":\"invalid claim: missing sub claim\"}\n",[21,82,80],{"__ignoreMap":23},[10,84,85],{},"Picture a front desk that has been asked one question: which visitor is this?\nYou hand over a badge. The desk checks the stamp on it first, and the stamp is\nreal. Then it reads the name line, and the name line is blank. The desk has\nnothing to answer with, so it refuses, and the refusal names the blank line.",[10,87,88,89,92,93,96],{},"Any call that needs a signed-in person can get this answer. ",[21,90,91],{},"getUser()"," and\n",[21,94,95],{},"updateUser()"," are the two you are most likely to see it from, and adding a\nsecond factor or linking another sign-in method goes through the same check.",[98,99],"diagram",{"alt":100,"caption":101,"src":102},"Two badges travel to the same front desk. Both carry a real seal and both pass the seal check. The upper badge, marked authenticated, has a face and a name, and the desk answers with a person and 200. The lower badge, marked anon, has an empty dashed photo and name line, and the desk answers 403.","The seal is checked first, and both badges pass it. The question that fails is the second one: whose name is on it.","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fthe-name-line-1600x720.png",[37,104,106],{"id":105},"a-key-names-your-app-a-session-token-names-a-person","A key names your app. A session token names a person.",[10,108,109],{},"Your project's API key is the badge with the blank name line, and it was made\nthat way on purpose.",[10,111,112,113,118],{},"Supabase's ",[52,114,117],{"href":115,"rel":116},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fgetting-started\u002Fapi-keys",[56],"API keys documentation","\nsays it in one line: \"An API key doesn't distinguish between users but between\napplications.\" The key tells Supabase which app is calling. Who is using that\napp is a separate question, answered by a token Supabase Auth issues to each\nperson when they sign in.",[10,120,121,122,125,126,128],{},"Supabase's JWT reference prints both. An older project's ",[21,123,124],{},"anon"," key decodes to\nthis, and there is no ",[21,127,49],{}," anywhere in it:",[14,130,133],{"className":131,"code":132,"language":19},[17],"{\n  \"iss\": \"supabase\",\n  \"ref\": \"abcdefghijklmnopqrst\",\n  \"role\": \"anon\",\n  \"iat\": 1640991600,\n  \"exp\": 1640995200\n}\n",[21,134,132],{"__ignoreMap":23},[10,136,137,138,141],{},"A signed-in person's access token carries their id, the role ",[21,139,140],{},"authenticated","\nand the session it belongs to (trimmed here to the lines that matter):",[14,143,146],{"className":144,"code":145,"language":19},[17],"{\n  \"sub\": \"123e4567-e89b-12d3-a456-426614174000\",\n  \"role\": \"authenticated\",\n  \"session_id\": \"123e4567-e89b-12d3-a456-426614174000\",\n  \"email\": \"user@example.com\"\n}\n",[21,147,145],{"__ignoreMap":23},[10,149,150,151,153,154,157,158,160,161,164,165,168,169,174],{},"The ",[21,152,29],{}," key is the first shape again with ",[21,155,156],{},"\"role\": \"service_role\"",",\nand still no ",[21,159,49],{},". The newer ",[21,162,163],{},"sb_publishable_"," and ",[21,166,167],{},"sb_secret_"," keys are not\nJWTs at all, but Supabase's\n",[52,170,173],{"href":171,"rel":172},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fauth-error-401-invalid-claim-missing-sub--AFwMR",[56],"troubleshooting page for this error","\nsays Auth recognises them and that they \"do not carry the sub claim\" either. So\nevery key your project has, old or new, public or secret, produces this message\nwhen it is handed to Auth as if it were a person. That same page names the\nmistake directly: \"inadvertently using a Supabase API key\" instead of the Auth\naccess token.",[10,176,177,178,182],{},"If keys and their prefixes are new to you,\n",[52,179,181],{"href":180},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","which API keys are safe in your frontend","\ncovers how to tell the public one from the secret one.",[37,184,186],{"id":185},"where-the-key-gets-sent-in-place-of-a-session","Where the key gets sent in place of a session",[10,188,189],{},"Three routes lead here, and the first one is the one an Edge Function takes.",[10,191,192,195,196,199,200,203],{},[32,193,194],{},"1. An Edge Function called from a page where nobody is signed in."," When\nsupabase-js has a session, it puts the person's token in the ",[21,197,198],{},"Authorization","\nheader. When it has none, it has nothing else to put there, so with a legacy\nkey it sends your project's key in that header instead. Its ",[21,201,202],{},"fetch.ts"," reads\nexactly that way: the session token if there is one, otherwise the key.",[10,205,206,207,211],{},"The platform's Verify JWT check lets that request in. A legacy key is a JWT your\nproject signed, and Supabase documents that the check accepts the newer keys as\nwell, which is the gap ",[52,208,210],{"href":209},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","moving a secret to an Edge Function","\nexplains in full. Your function then passes the header on to Auth, which is what\nthese lines do:",[14,213,218],{"className":214,"code":216,"language":217,"meta":23},[215],"language-ts","const supabase = createClient(\n  Deno.env.get('SUPABASE_URL')!,\n  Deno.env.get('SUPABASE_ANON_KEY')!,\n  { global: { headers: { Authorization: req.headers.get('Authorization')! } } },\n)\nconst { data: { user } } = await supabase.auth.getUser()\n","ts",[21,219,216],{"__ignoreMap":23},[10,221,222,223,226],{},"Auth reads the key, finds the blank name line, and answers 403. If the function\nhands that failure back, your app shows ",[21,224,225],{},"Edge Function returned a non-2xx status code",", with this message waiting in the function's log.",[10,228,229,232,233,236],{},[32,230,231],{},"2. A call made before sign-in had finished."," Supabase's troubleshooting page\nnames this one as well: a user who started to sign up or sign in and had not\ncompleted it when ",[21,234,235],{},"getUser"," was called. One shape this takes is a sign-up still\nwaiting for its confirmation email. There is no session yet, so whatever reached\nAuth was not a person's token.",[10,238,239,242,243,246,247,250,251,254,255,257,258,260],{},[32,240,241],{},"3. Your own server hands Auth the wrong value."," A route that calls\n",[21,244,245],{},"getUser(token)"," with the key in ",[21,248,249],{},"token",", or an automation in n8n, Make or\nPostman that calls ",[21,252,253],{},"\u002Fauth\u002Fv1\u002Fuser"," with the key in its ",[21,256,198],{}," header.\nThe fix Supabase's page gives for this case is to make sure the token passed to\n",[21,259,91],{}," is the person's access token.",[98,262],{"alt":263,"caption":264,"src":265},"A page with nobody signed in sends two identical blank badges, one marked apikey and one marked Authorization. Both pass the platform's check with a tick and reach the Edge Function. The function forwards the Authorization badge to the front desk, which answers 403 with a cross.","With nobody signed in, the page sends the same key in both headers. Every check before Auth lets it through, and only Auth's question finds the name line empty.","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fthe-same-key-twice-1600x760.png",[37,267,269],{"id":268},"how-to-see-which-one-your-function-received","How to see which one your function received",[10,271,272],{},"Compare two request headers in your browser.",[10,274,275,276,279,280,283],{},"Open your live app, press F12, choose the ",[32,277,278],{},"Network"," tab and repeat whatever\nfailed. Click the request whose address contains ",[21,281,282],{},"\u002Ffunctions\u002Fv1\u002F"," and your\nfunction's name, and read its request headers:",[285,286,287,304,315],"ul",{},[288,289,290,303],"li",{},[32,291,292,294,295,298,299,302],{},[21,293,198],{}," holds ",[21,296,297],{},"Bearer"," and then the same string as ",[21,300,301],{},"apikey","."," The\npage had no session to send, so it sent the key twice. You are on route 1 or\n2.",[288,305,306,314],{},[32,307,308,310,311,302],{},[21,309,198],{}," holds a different long string beginning ",[21,312,313],{},"eyJ"," A person's\ntoken went out. The function or your server lost it on the way, so you are on\nroute 3.",[288,316,317,323,324,328,329,332],{},[32,318,319,320,322],{},"There is no ",[21,321,198],{}," header."," Then this message is not the one you\nwill meet. With Verify JWT on, the platform refuses the request with a 401\nbefore your code runs, which\n",[52,325,327],{"href":326},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","the non-2xx post"," reads.\nWith it off, Auth answers ",[21,330,331],{},"This endpoint requires a valid Bearer token",", the\nfirst row of the table further down.",[10,334,335,336,339,340,344],{},"If the message is in your browser's console instead, and reads\n",[21,337,338],{},"Auth session missing!",", no request reached Auth at all: supabase-js found no\nsession and stopped before sending one, which\n",[52,341,343],{"href":342},"\u002Fblog\u002Fauth-session-missing","its own post"," covers.",[10,346,347],{},"Read the values where they are. Do not paste either one into a website that\noffers to decode it: your key is public anyway, but a person's access token\nlets whoever holds it act as that person until it expires.",[37,349,351],{"id":350},"the-fix-ask-only-when-someone-is-signed-in","The fix: ask only when someone is signed in",[10,353,354],{},"Decide what the function should do for a visitor who has not signed in, and\nwrite that decision into the function.",[10,356,357,360,361,363],{},[32,358,359],{},"If only signed-in people should use it,"," two changes. The page calls the\nfunction only once somebody has signed in. And the function answers a plain 401\nwhen ",[21,362,91],{}," finds no user, so a stray call from a signed-out page gets a\nclear refusal instead of a crash:",[14,365,368],{"className":366,"code":367,"language":217,"meta":23},[215],"const { data: { user } } = await supabase.auth.getUser()\nif (!user) {\n  return new Response(JSON.stringify({ error: 'Sign in first' }), {\n    status: 401,\n    headers: { ...corsHeaders, 'Content-Type': 'application\u002Fjson' },\n  })\n}\n",[21,369,367],{"__ignoreMap":23},[10,371,372,373,377,378,381,382,385],{},"Keep the CORS headers on that reply as well, or the browser hides it from your\napp and you meet\n",[52,374,376],{"href":375},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\"","\ninstead. Supabase also ships a wrapper, ",[21,379,380],{},"withSupabase({ auth: 'user' })",", that\nmakes the same check before your handler runs; the\n",[52,383,384],{"href":209},"Edge Function post"," shows the setup.",[10,387,388,391],{},[32,389,390],{},"If signed-out visitors should use it too,"," ask Auth only on the path that\nneeds a person. Treat a refusal there as \"this is a visitor\" and carry on with\nwhat a visitor is allowed, rather than letting the error stop the request.",[10,393,394,397,398,401,402,405],{},[32,395,396],{},"On your own server,"," send the person's access token from the browser, as\nSupabase's page describes: put it in an ",[21,399,400],{},"Authorization: Bearer"," header on your\nrequest, read it on the server, and call ",[21,403,404],{},"supabase.auth.getUser(token)"," with\nthat value. Your project's key never goes into that call.",[37,407,409],{"id":408},"two-fixes-that-make-it-worse","Two fixes that make it worse",[10,411,412],{},"Both get suggested for this error, and both leave you worse off than the error\ndid.",[10,414,415,418,419,92,421,423,424,426,427,302],{},[32,416,417],{},"Swapping in the secret key."," It cannot help, because ",[21,420,29],{},[21,422,167],{}," carry no ",[21,425,49],{}," either, so Auth answers the same way. The harm is in\nwhere the key ends up. Ask a builder to \"use the service key\" to get past an\nerror and it may well put it in the page your visitors download, where it reads\nand writes every row in your database whatever your rules say. If that has\nalready happened, ",[52,428,430],{"href":429},"\u002Fblog\u002Frotate-supabase-service-role-key","rotate it first",[10,432,433,434,302],{},"You can see that mistake from outside. Our free scan reads your live app's\nJavaScript the way a stranger would and names every key it finds, including\nwhether it is one that belongs there. It takes about 20 seconds and needs no\naccount: ",[52,435,437],{"href":436},"\u002Fsecurity-scanner","scan your app",[10,439,440,443,444,447],{},[32,441,442],{},"Deleting the check and taking the user's id from the request."," A function\nthat reads ",[21,445,446],{},"userId"," from the body believes whoever sends it. If that function\nalso uses the secret key to write, anyone who opens your page and reads how the\nfunction is called can act as any of your users, and nothing in your logs says\nit was not them. With the check left in, a stranger who tries the same call gets\nthis error back and nothing else.",[37,449,451],{"id":450},"the-other-messages-from-the-same-check","The other messages from the same check",[10,453,454],{},"Auth's checks run in a fixed order and each one has its own sentence, so the\nmessage tells you how far the token got.",[456,457,458,474],"table",{},[459,460,461],"thead",{},[462,463,464,468,471],"tr",{},[465,466,467],"th",{},"Message",[465,469,470],{},"Status and code",[465,472,473],{},"What happened",[475,476,477,496,511,525,540,555],"tbody",{},[462,478,479,484,490],{},[480,481,482],"td",{},[21,483,331],{},[480,485,486,487],{},"401 ",[21,488,489],{},"no_authorization",[480,491,492,493,495],{},"No ",[21,494,400],{}," header arrived at all.",[462,497,498,503,508],{},[480,499,500],{},[21,501,502],{},"invalid JWT: unable to parse or verify signature, …",[480,504,505,506],{},"403 ",[21,507,75],{},[480,509,510],{},"The stamp is wrong: a damaged token, one from another project, or an old key.",[462,512,513,518,522],{},[480,514,515],{},[21,516,517],{},"invalid claim: missing sub claim",[480,519,505,520],{},[21,521,75],{},[480,523,524],{},"The stamp is right and the name line is blank: an API key.",[462,526,527,532,537],{},[480,528,529],{},[21,530,531],{},"invalid claim: sub claim must be a UUID",[480,533,534,535],{},"400 ",[21,536,75],{},[480,538,539],{},"A name is there, and it is not in the form of a Supabase user id.",[462,541,542,547,552],{},[480,543,544],{},[21,545,546],{},"User from sub claim in JWT does not exist",[480,548,505,549],{},[21,550,551],{},"user_not_found",[480,553,554],{},"The token names a user who has since been deleted.",[462,556,557,562,567],{},[480,558,559],{},[21,560,561],{},"Session from session_id claim in JWT does not exist",[480,563,505,564],{},[21,565,566],{},"session_not_found",[480,568,569],{},"The token outlived its session, for example after a sign-out on another device.",[10,571,572,573,575,576,579,580,584,585,302],{},"Every row comes from the same file, ",[21,574,68],{},". Your database's own\nversion of the wrong-stamp row, ",[21,577,578],{},"PGRST301",", has\n",[52,581,583],{"href":582},"\u002Fblog\u002Fsupabase-invalid-jwt","a post of its own",". The session row is the one to\nread alongside ",[52,586,588],{"href":587},"\u002Fblog\u002Fsupabase-users-logged-out","why Supabase users get logged out",[37,590,592],{"id":591},"keeping-the-check-in-place-after-the-next-change","Keeping the check in place after the next change",[10,594,595,598],{},[32,596,597],{},"A check on who is calling can disappear the next time you ask your builder to\nmake an error go away",", and the two quickest ways to silence this one are the\ntwo above.",[10,600,601],{},[32,602,603,607],{},[52,604,606],{"href":605},"\u002Fwebsite-monitoring","Reeve Monitor"," re-scans your live app every hour:",[285,609,610,613,616,619],{},[288,611,612],{},"all nine checks every hour, on up to three apps",[288,614,615],{},"an email the day a re-scan grades your app lower than the one before; a secret key in your JavaScript caps the grade at D on its own",[288,617,618],{},"whether the app is up, every 60 seconds",[288,620,621],{},"a monthly report of what it saw",[10,623,624],{},[32,625,626,627,631],{},"A function that trusts the user id it is sent can change any of your users'\nrows for whoever calls it. ",[52,628,630],{"href":629},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your\nSupabase database from before that happens.",[285,633,634,637,640,643,646],{},[288,635,636],{},"an encrypted copy on a schedule, kept on Reeve's own storage in the EU, outside your Supabase account",[288,638,639],{},"each copy verified before it counts, by counting the rows in every table",[288,641,642],{},"a one-click restore that saves what is there now before it replaces anything",[288,644,645],{},"your uploaded files as well, once you connect a Storage credential",[288,647,648],{},"everything Monitor does",[37,650,652],{"id":651},"what-to-do-now","What to do now",[654,655,656],"key-takeaways",{},[285,657,658,667,673,679,682],{},[288,659,660,661,663,664,666],{},"Open the failing request in the Network tab. If ",[21,662,198],{}," carries the same value as ",[21,665,301],{},", nobody was signed in when it was sent.",[288,668,669,670,672],{},"Call functions that need a person only after sign-in, and have the function answer 401 when ",[21,671,91],{}," finds no user.",[288,674,675,676,678],{},"On your own server, pass the person's access token to ",[21,677,91],{},". Your project's key has no user in it.",[288,680,681],{},"Leave the secret key where it is. It names nobody either, and in the page it reads and writes every row.",[288,683,684],{},"Keep the check on who is calling. A function that takes the user's id from the request believes anyone.",[10,686,687,688,690,691,694,695,699],{},"If your app shows ",[21,689,225],{}," while this\nmessage sits in the log, the function is passing the refusal on, and\n",[52,692,693],{"href":326},"that post"," reads the reply\nfrom there. The ",[52,696,698],{"href":697},"\u002Fchecklist","10-minute security checklist"," covers what else a\nnewly launched app tends to leave open.",{"title":23,"searchDepth":701,"depth":701,"links":702},3,[703,705,706,707,708,709,710,711,712],{"id":39,"depth":704,"text":40},2,{"id":105,"depth":704,"text":106},{"id":185,"depth":704,"text":186},{"id":268,"depth":704,"text":269},{"id":350,"depth":704,"text":351},{"id":408,"depth":704,"text":409},{"id":450,"depth":704,"text":451},{"id":591,"depth":704,"text":592},{"id":651,"depth":704,"text":652},"Security basics","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcover-1200x630.png","An ID badge on a lanyard with a genuine seal and a blank name line, in front of two badges that carry a name and a face.","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.",false,"md",[720,723,726,729,732],{"q":721,"a":722},"What does \"invalid claim: missing sub claim\" mean in Supabase?","It means Supabase Auth was asked which user is calling and was handed a token with no user in it. The token itself was genuine and passed the signature check. What it lacked was the sub claim, the field that holds a user id. That is what your project's API keys look like, which is why the usual cause is a key sent where a signed-in user's token belongs.",{"q":724,"a":725},"Is it the same as \"Auth session missing!\"?","No. \"Auth session missing!\" comes from supabase-js in the browser, which finds no session and does not send the request at all. \"invalid claim: missing sub claim\" comes back from Supabase Auth, which received a request and found a key where the user's token should be. The first usually means a signed-out page; the second usually means a function or server passed the key on.",{"q":727,"a":728},"Will turning off Verify JWT fix it?","No. Verify JWT is a check Supabase runs on an Edge Function before your code starts, and this message comes later, from Supabase Auth, when your code asks who is calling. Turning the platform check off lets requests with no token at all reach your code as well, and it leaves this error exactly where it was.",{"q":730,"a":731},"Does an anonymous sign-in cause this error?","No. An anonymous sign-in creates a real user with an id of its own, so its token carries a sub claim and is_anonymous set to true. The anon key is a different thing that shares the name: a project key with no user in it, and it is the one that produces this message.",{"q":733,"a":734},"Why do some pages say 401 and others 403?","Supabase's troubleshooting page for this message has 401 in its title. The current Supabase Auth code answers 403, with the error code bad_jwt. If your code decides what to do from the status alone, check the error code and the message as well.","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",[737,517,738,739,740,741,742],"invalid claim missing sub claim supabase","AuthApiError invalid claim missing sub claim","bad_jwt supabase","supabase getuser 403","supabase edge function getuser error","supabase anon key getuser",{},true,"\"invalid claim: missing sub claim\" in Supabase","\u002Fblog\u002Finvalid-claim-missing-sub-claim","2026-11-04",{"title":5,"description":716},"blog\u002Finvalid-claim-missing-sub-claim",[751,752,753],"\"invalid claim: missing sub claim\" is Supabase Auth answering 403 with the code bad_jwt. It was asked who is calling, the token it got was genuine, and the token named nobody.","Supabase's own troubleshooting page names the common cause: an API key sent where a signed-in user's access token belongs. A key says which app is calling and has no person in it.","Call the function only once somebody is signed in, and have it answer 401 when nobody is. Swapping in the secret key changes nothing, because that key names nobody either.","z1cUlkl6Z8MfEl1KivmNohBzC4MDwAyxGgQ7iLtSxhQ",[756,762,768,774,780,785,786,791,797,803,809,816,822,828,833,839,845,851,857,863,869,875,880,886,892,897,903,909,915,921,927,933,939,945,951,957,962,968,974,980,986,992,998,1004,1010,1016,1021,1027,1033,1039,1045,1051,1057,1063,1069,1075,1081,1087,1093,1099,1105,1111,1117,1123,1128,1134,1140,1146,1152,1158,1164,1170,1176,1182,1188,1194,1200,1206,1212,1218,1224,1230,1236,1242,1247,1253,1259,1265,1270,1276],{"path":757,"title":758,"description":759,"published":760,"category":713,"image":761,"draft":717},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":763,"title":764,"description":765,"published":766,"category":713,"image":767,"draft":717},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":769,"title":770,"description":771,"published":772,"category":713,"image":773,"draft":717},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":775,"title":776,"description":777,"published":778,"category":713,"image":779,"draft":717},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":342,"title":781,"description":782,"published":783,"category":713,"image":784,"draft":717},"Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":746,"title":5,"description":716,"published":747,"category":713,"image":735,"draft":717},{"path":375,"title":787,"description":788,"published":789,"category":713,"image":790,"draft":717},"\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":792,"title":793,"description":794,"published":795,"category":713,"image":796,"draft":717},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":798,"title":799,"description":800,"published":801,"category":713,"image":802,"draft":717},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":804,"title":805,"description":806,"published":807,"category":713,"image":808,"draft":717},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":810,"title":811,"description":812,"published":813,"category":814,"image":815,"draft":717},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":817,"title":818,"description":819,"published":820,"category":713,"image":821,"draft":717},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":823,"title":824,"description":825,"published":826,"category":713,"image":827,"draft":717},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":326,"title":829,"description":830,"published":831,"category":713,"image":832,"draft":717},"\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":834,"title":835,"description":836,"published":837,"category":713,"image":838,"draft":717},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":840,"title":841,"description":842,"published":843,"category":713,"image":844,"draft":717},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":846,"title":847,"description":848,"published":849,"category":713,"image":850,"draft":717},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":852,"title":853,"description":854,"published":855,"category":713,"image":856,"draft":717},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":858,"title":859,"description":860,"published":861,"category":713,"image":862,"draft":717},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":864,"title":865,"description":866,"published":867,"category":713,"image":868,"draft":717},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":870,"title":871,"description":872,"published":873,"category":713,"image":874,"draft":717},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":587,"title":876,"description":877,"published":878,"category":713,"image":879,"draft":717},"Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":881,"title":882,"description":883,"published":884,"category":713,"image":885,"draft":717},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":887,"title":888,"description":889,"published":890,"category":713,"image":891,"draft":717},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":582,"title":893,"description":894,"published":895,"category":713,"image":896,"draft":717},"Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":898,"title":899,"description":900,"published":901,"category":713,"image":902,"draft":717},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":904,"title":905,"description":906,"published":907,"category":713,"image":908,"draft":717},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":910,"title":911,"description":912,"published":913,"category":713,"image":914,"draft":717},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":916,"title":917,"description":918,"published":919,"category":713,"image":920,"draft":717},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":922,"title":923,"description":924,"published":925,"category":713,"image":926,"draft":717},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":928,"title":929,"description":930,"published":931,"category":713,"image":932,"draft":717},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":934,"title":935,"description":936,"published":937,"category":713,"image":938,"draft":717},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":940,"title":941,"description":942,"published":943,"category":713,"image":944,"draft":717},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":946,"title":947,"description":948,"published":949,"category":713,"image":950,"draft":717},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":952,"title":953,"description":954,"published":955,"category":713,"image":956,"draft":717},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":209,"title":958,"description":959,"published":960,"category":713,"image":961,"draft":717},"Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":963,"title":964,"description":965,"published":966,"category":713,"image":967,"draft":717},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":969,"title":970,"description":971,"published":972,"category":713,"image":973,"draft":717},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":975,"title":976,"description":977,"published":978,"category":713,"image":979,"draft":717},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":981,"title":982,"description":983,"published":984,"category":713,"image":985,"draft":717},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":987,"title":988,"description":989,"published":990,"category":713,"image":991,"draft":717},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":993,"title":994,"description":995,"published":996,"category":713,"image":997,"draft":717},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":999,"title":1000,"description":1001,"published":1002,"category":814,"image":1003,"draft":717},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":1005,"title":1006,"description":1007,"published":1008,"category":814,"image":1009,"draft":717},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":1011,"title":1012,"description":1013,"published":1014,"category":814,"image":1015,"draft":717},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":1017,"title":1018,"description":1019,"published":1014,"category":713,"image":1020,"draft":717},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":1022,"title":1023,"description":1024,"published":1025,"category":713,"image":1026,"draft":717},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":1028,"title":1029,"description":1030,"published":1031,"category":713,"image":1032,"draft":717},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":1034,"title":1035,"description":1036,"published":1037,"category":814,"image":1038,"draft":717},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":1040,"title":1041,"description":1042,"published":1043,"category":713,"image":1044,"draft":717},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":1046,"title":1047,"description":1048,"published":1049,"category":713,"image":1050,"draft":717},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":1052,"title":1053,"description":1054,"published":1055,"category":713,"image":1056,"draft":717},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":1058,"title":1059,"description":1060,"published":1061,"category":713,"image":1062,"draft":717},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":1064,"title":1065,"description":1066,"published":1067,"category":713,"image":1068,"draft":717},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":1070,"title":1071,"description":1072,"published":1073,"category":713,"image":1074,"draft":717},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1076,"title":1077,"description":1078,"published":1079,"category":713,"image":1080,"draft":717},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1082,"title":1083,"description":1084,"published":1085,"category":713,"image":1086,"draft":717},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1088,"title":1089,"description":1090,"published":1091,"category":814,"image":1092,"draft":717},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1094,"title":1095,"description":1096,"published":1097,"category":814,"image":1098,"draft":717},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1100,"title":1101,"description":1102,"published":1103,"category":814,"image":1104,"draft":717},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1106,"title":1107,"description":1108,"published":1109,"category":713,"image":1110,"draft":717},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":1112,"title":1113,"description":1114,"published":1115,"category":713,"image":1116,"draft":717},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1118,"title":1119,"description":1120,"published":1121,"category":713,"image":1122,"draft":717},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":429,"title":1124,"description":1125,"published":1126,"category":713,"image":1127,"draft":717},"How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1129,"title":1130,"description":1131,"published":1132,"category":713,"image":1133,"draft":717},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1135,"title":1136,"description":1137,"published":1138,"category":713,"image":1139,"draft":717},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1141,"title":1142,"description":1143,"published":1144,"category":713,"image":1145,"draft":717},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1147,"title":1148,"description":1149,"published":1150,"category":713,"image":1151,"draft":717},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1153,"title":1154,"description":1155,"published":1156,"category":713,"image":1157,"draft":717},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1159,"title":1160,"description":1161,"published":1162,"category":713,"image":1163,"draft":717},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1165,"title":1166,"description":1167,"published":1168,"category":814,"image":1169,"draft":717},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1171,"title":1172,"description":1173,"published":1174,"category":713,"image":1175,"draft":717},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1177,"title":1178,"description":1179,"published":1180,"category":814,"image":1181,"draft":717},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1183,"title":1184,"description":1185,"published":1186,"category":713,"image":1187,"draft":717},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1189,"title":1190,"description":1191,"published":1192,"category":713,"image":1193,"draft":717},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1195,"title":1196,"description":1197,"published":1198,"category":713,"image":1199,"draft":717},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1201,"title":1202,"description":1203,"published":1204,"category":713,"image":1205,"draft":717},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1207,"title":1208,"description":1209,"published":1210,"category":814,"image":1211,"draft":717},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1213,"title":1214,"description":1215,"published":1216,"category":814,"image":1217,"draft":717},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1219,"title":1220,"description":1221,"published":1222,"category":713,"image":1223,"draft":717},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1225,"title":1226,"description":1227,"published":1228,"category":713,"image":1229,"draft":717},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1231,"title":1232,"description":1233,"published":1234,"category":814,"image":1235,"draft":717},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1237,"title":1238,"description":1239,"published":1240,"category":713,"image":1241,"draft":717},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1243,"title":1244,"description":1245,"published":1240,"category":713,"image":1246,"draft":717},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1248,"title":1249,"description":1250,"published":1251,"category":713,"image":1252,"draft":717},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1254,"title":1255,"description":1256,"published":1257,"category":814,"image":1258,"draft":717},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1260,"title":1261,"description":1262,"published":1263,"category":713,"image":1264,"draft":717},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1266,"title":1267,"description":1268,"published":1263,"category":814,"image":1269,"draft":717},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1271,"title":1272,"description":1273,"published":1274,"category":814,"image":1275,"draft":717},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":180,"title":1277,"description":1278,"published":1274,"category":713,"image":1279,"draft":717},"Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]