[{"data":1,"prerenderedAt":1066},["ShallowReactive",2],{"blog-en-is-supabase-down-or-your-app":3,"blog-index-en":712},{"id":4,"title":5,"body":6,"category":666,"cover":667,"coverAlt":668,"description":669,"draft":670,"extension":671,"faq":672,"image":690,"keywords":691,"meta":701,"navigation":702,"ogTitle":26,"path":703,"published":704,"seo":705,"stem":706,"tldr":707,"updated":704,"__hash__":711},"blog_en\u002Fblog\u002Fis-supabase-down-or-your-app.md","Is Supabase down, or is it your app? How to tell",{"type":7,"value":8,"toc":648},"minimark",[9,13,16,19,22,27,30,59,62,68,71,75,80,91,103,109,112,117,120,123,127,135,139,142,163,169,172,186,189,193,196,211,238,247,367,373,377,380,445,459,463,466,469,472,476,479,482,487,490,516,525,529,532,565,569,574,600,612,616,642],[10,11,12],"p",{},"Your app opens, and then nothing loads. The list that should show your\ncustomers' orders is empty, the sign-in button spins, or the page stays white.\nSomebody has already messaged you about it. So you search \"is Supabase down\",\nbecause your app was built with Lovable or Bolt on top of a Supabase project, and\nSupabase is the only part of the machinery you know by name.",[10,14,15],{},"Here is where the usual answer goes wrong. It says: check Supabase's status page.\nThat is the right first move, and it answers one question out of four. Your\nproject stops answering your app when Supabase has an outage, and also when\nSupabase has paused it, when it has hit a limit, and when your own app is broken\nwhile Supabase answers every request correctly. Your customer sees the same\nblank screen in all four cases, and the status page knows about the first.",[10,17,18],{},"Think of it as the lights going out at home. The first thing anyone does is look\nout of the window to see whether the neighbours are dark too. That is the status\npage, and it tells you about the street. It says nothing about the letter on the\ndoormat, the fuse box in the hall, or the bulb.",[10,20,21],{},"Every Supabase page, incident and figure below was read on 30 September 2026.",[23,24,26],"h2",{"id":25},"is-supabase-down-or-is-it-your-app","Is Supabase down, or is it your app?",[10,28,29],{},"You cannot tell from the screen, which is why the search leaves people stuck.\nFour different failures produce the same result:",[31,32,33,41,47,53],"ol",{},[34,35,36,40],"li",{},[37,38,39],"strong",{},"Supabase is down."," Something on Supabase's side has failed, usually in\none region or one service. The street has gone dark.",[34,42,43,46],{},[37,44,45],{},"Your project is paused."," Supabase stops free projects that have had no\nactivity for about a week. Your supply has been disconnected, and nobody else\non the street is affected.",[34,48,49,52],{},[37,50,51],{},"Your project has hit a limit."," It filled its space and went read-only, or\nran short of capacity and slowed until requests timed out, or your\norganization went over a quota and was restricted. A breaker has tripped.",[34,54,55,58],{},[37,56,57],{},"Your app is broken."," Supabase is answering, and something on your side, a\nkey, a table's access rules or a piece of code, turns that answer into a\nblank screen. The power is fine. It is the bulb.",[10,60,61],{},"Your project, here and below, means the Supabase database your app keeps its\ndata in, together with the sign-in, file storage and API around it.",[63,64],"diagram",{"alt":65,"caption":66,"src":67},"Four tiles on the left, each drawn in amber: a cloud, a pause sign, a tripped switch and a code editor. Their lines join and run into one blank browser window with a loading ring in it.","Four different failures, one screen. Your customer has no way to tell them apart, and neither do you until you check.","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Ffour-causes-one-screen-1600x620.png",[10,69,70],{},"The checks below take them in order, cheapest first, and each one rules a\nfailure in or out.",[23,72,74],{"id":73},"four-checks-cheapest-first","Four checks, cheapest first",[76,77,79],"h3",{"id":78},"step-1-is-supabase-down-for-everyone","Step 1: is Supabase down for everyone?",[10,81,82,83,90],{},"Open ",[84,85,89],"a",{"href":86,"rel":87},"https:\u002F\u002Fstatus.supabase.com\u002F",[88],"nofollow","status.supabase.com",". If an open incident\nnames your region or a service your app uses, you have your answer, and the\nsection on outages further down is what to do with it.",[10,92,93,94,98,99,102],{},"The page lists Supabase's services one at a time: the database and the API your\napp reads it through, Auth for sign-in, Storage for uploaded files, Realtime,\nEdge Functions, the dashboard and a few more. Below them is a list of regions. A\nregion is the part of the world your project runs in, and yours is shown on the\nproject's Infrastructure settings page, with a code such as ",[95,96,97],"code",{},"eu-west-1",". An\nincident in ",[95,100,101],{},"us-east-1"," has nothing to do with a project in Ireland, so find\nyour code before you read anything else.",[10,104,105,106,108],{},"What the page does not have is a row for your project. It reports problems that\naffect enough projects to announce, and real incidents are often narrow. The\nfifty most recent on it, running back to 15 July 2026, include one that took\ndown only the projects on one set of hardware in ",[95,107,97],{},", one that left\nprojects on the smallest, free-plan size unresponsive after a few hours of\nrunning, and one about 401 errors on a subset of new projects that stayed open\nfor 46 days.",[10,110,111],{},"So a green page tells you Supabase has not announced a problem. Your project can\nbe down underneath it, and the next three checks are about that.",[63,113],{"alt":114,"caption":115,"src":116},"A status board with every row lit green. Below it, a row of projects, all lit except one, which is dark and ringed.","The status page reports on Supabase as a whole. It has no row for your project.","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fgreen-page-dark-project-1600x620.png",[10,118,119],{},"The dashboard has a row and incidents of its own. On 1 September 2026 people\ncould not log in to it at all, and an app can keep running through one of\nthose.",[10,121,122],{},"While you are on the page, subscribe to updates. It takes an email address, and\nSupabase also publishes the incident history as an RSS feed.",[76,124,126],{"id":125},"step-2-is-your-project-paused","Step 2: is your project paused?",[10,128,129,130,134],{},"Open the Supabase dashboard and look at your list of projects. A project with\nPaused beside its name was stopped by Supabase, most often a free project that\nwent about a week without activity, and it stays stopped until you resume it.\nEverything else about a pause, including the one-year deadline and what to do\nonce the option to resume has gone, is in\n",[84,131,133],{"href":132},"\u002Fblog\u002Fsupabase-project-paused-recover","what to do when your Supabase project is paused",".",[76,136,138],{"id":137},"step-3-has-your-project-hit-a-limit","Step 3: has your project hit a limit?",[10,140,141],{},"Look at what still works. Each limit breaks something different, and the pattern\ntells you which one has tripped.",[10,143,144,147,148,151,152,156,157,162],{},[37,145,146],{},"Pages load and nothing saves."," That is read-only mode. A free project goes\nread-only when its database passes 500 MB, and a paid one when its disk fills\nfaster than Supabase is allowed to grow it. Reading still works, so the app\nlooks fine until somebody tries to sign up, place an order or save a form, and\nevery write comes back with ",[95,149,150],{},"cannot execute INSERT in a read-only transaction",".\nThe way out is more space, by upgrading or by deleting data.\n",[84,153,155],{"href":154},"\u002Fblog\u002Fsupabase-free-plan-limits","What each free-plan limit switches off"," covers\nboth, and Supabase's\n",[84,158,161],{"href":159,"rel":160},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fplatform\u002Fdatabase-size",[88],"database size guide","\nhas the SQL.",[10,164,165,168],{},[37,166,167],{},"Everything slows down, then stops answering."," The project has run out of\nheadroom. Its compute size sets how much memory it has and how hard it can work\nits disk, and the smaller sizes get a daily allowance for bursting above that,\nwhich Supabase calls the Disk IO Budget. Once it is spent, Supabase's own list\nof what can follow includes response times that rise noticeably and an instance\nthat becomes unresponsive. The budget refills the next day, and the Database\nHealth page under Observability shows where you stand.",[10,170,171],{},"You may get an email saying the project \"is running out of Disk IO Budget\", or\nsee a notice in the dashboard that it is unhealthy, with a Restart project\nbutton under it. Read the email as a clue. After an incident on 10 September\n2026, Supabase told the owners caught up in it that the Disk IO email they had\nreceived was no longer valid: the incident had caused it.",[10,173,174,177,178,181,182,185],{},[37,175,176],{},"Every request fails with a 402."," Your organization has been restricted under\nSupabase's Fair Use Policy, for staying over a quota after its grace period or\nfor an unpaid bill, and the restriction usually covers every project in the\norganization. The 402 names the reason with a code such as\n",[95,179,180],{},"exceed_db_size_quota"," or ",[95,183,184],{},"overdue_payment",", and Supabase says you can still\nreach your data through the dashboard while it lasts. Upgrading lifts a usage\nrestriction at once; otherwise it lifts when the next billing cycle starts.",[10,187,188],{},"This is the fuse box. All three happen inside your own project, so the status\npage shows none of them.",[76,190,192],{"id":191},"step-4-ask-your-project-directly","Step 4: ask your project directly",[10,194,195],{},"Send it one request and read the answer. If Supabase answers normally, the fault\nis on your side of the connection.",[10,197,198,199,202,203,206,207,210],{},"The quickest version needs no tools. Your project's address looks like\n",[95,200,201],{},"https:\u002F\u002Fabcdefghijklmnopqrst.supabase.co",", and the string of letters before\n",[95,204,205],{},".supabase.co"," is in your browser's address bar whenever the project is open in\nthe dashboard. Put ",[95,208,209],{},"\u002Frest\u002Fv1\u002F"," on the end, paste it into a new tab and look at\nwhat comes back.",[212,213,214,220,232],"ul",{},[34,215,216,219],{},[37,217,218],{},"A line of text in curly brackets saying no API key was found."," Supabase is\nanswering at your project's address. It turned you away because the tab sent\nno key, which is correct. The project exists and it is not paused.",[34,221,222,225,226,231],{},[37,223,224],{},"\"This site can't be reached\", or \"server not found\"."," The address does not\nresolve. Supabase's\n",[84,227,230],{"href":228,"rel":229},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fnxdomain-error-connecting-to-a-supabase-project",[88],"troubleshooting page for that error","\nnames the usual reasons: a paused project, a deleted one, or a mistyped\naddress.",[34,233,234,237],{},[37,235,236],{},"An error page with a number in the 500s, or nothing after a long wait."," The\naddress exists and the project behind it is struggling. Go back to step 3, and\nlook at the status page again.",[10,239,240,241,246],{},"The fuller version is your browser's Network tab, which shows the answers your\napp is getting with its own key attached. Open your app, press F12, choose\nNetwork, reload the page, and type the letters from your project's address into\nthe filter box. Every request to your project appears with a status code, and\nthe code is most of the diagnosis. The meanings below are from Supabase's\n",[84,242,245],{"href":243,"rel":244},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fhttp-status-codes",[88],"list of status codes","\nand the database API it runs:",[248,249,250,266],"table",{},[251,252,253],"thead",{},[254,255,256,260,263],"tr",{},[257,258,259],"th",{},"Status",[257,261,262],{},"What it means",[257,264,265],{},"Where to go",[267,268,269,283,299,312,325,338,356],"tbody",{},[254,270,271,277,280],{},[272,273,274],"td",{},[95,275,276],{},"200",[272,278,279],{},"Supabase answered and sent something back",[272,281,282],{},"Your app, below",[254,284,285,293,296],{},[272,286,287,181,290],{},[95,288,289],{},"401",[95,291,292],{},"403",[272,294,295],{},"Supabase answered and refused the key, the table or the sign-in session",[272,297,298],{},"The next section",[254,300,301,306,309],{},[272,302,303],{},[95,304,305],{},"402",[272,307,308],{},"Your organization is restricted",[272,310,311],{},"Step 3",[254,313,314,320,323],{},[272,315,316,319],{},[95,317,318],{},"405"," on saves, while reads get 200",[272,321,322],{},"The database is read-only",[272,324,311],{},[254,326,327,332,335],{},[272,328,329],{},[95,330,331],{},"540",[272,333,334],{},"The project is paused",[272,336,337],{},"Step 2",[254,339,340,350,353],{},[272,341,342,345,346,349],{},[95,343,344],{},"503",", ",[95,347,348],{},"544",", or no answer",[272,351,352],{},"The project is up and cannot keep up",[272,354,355],{},"Step 3, then a restart",[254,357,358,361,364],{},[272,359,360],{},"failed, with \"name not resolved\"",[272,362,363],{},"The address does not exist right now",[272,365,366],{},"Step 2, then check the address",[10,368,369,370,372],{},"The row to look for first is ",[95,371,276],{},". If your app's requests to Supabase come back\n200 and the screen is still blank, Supabase has done its part, and the bulb is\nyours. A table's rules may be letting this visitor see no rows, which arrives as\na 200 carrying an empty list. The app may be pointed at a different project from\nthe one you are looking at. Or the code that draws the page broke on what it was\ngiven, which is a question for your builder, with the request and its answer in\nhand.",[23,374,376],{"id":375},"why-am-i-suddenly-getting-401-errors-from-supabase","Why am I suddenly getting 401 errors from Supabase?",[10,378,379],{},"Because Supabase answered and refused who was asking. A 401 means the request\nreached your project, so the platform is up. What it rejected is one of three\nthings, and the message says which: click the request in the Network tab and\nopen its Response.",[212,381,382,419,433],{},[34,383,384,387,388,391,392,395,396,399,400,403,404,409,410,413,414,418],{},[37,385,386],{},"The key."," The message says ",[95,389,390],{},"Invalid API key"," or\n",[95,393,394],{},"Legacy API keys are disabled",". Your app is sending a key the project no longer\naccepts. The older ",[95,397,398],{},"anon"," key, a long string beginning ",[95,401,402],{},"eyJ",", stops working\nwhen someone switches the legacy keys off in the project's settings, and\nSupabase has warned that a paused project restored since 1 November 2025 comes\nback without it: in\n",[84,405,408],{"href":406,"rel":407},"https:\u002F\u002Fgithub.com\u002Forgs\u002Fsupabase\u002Fdiscussions\u002F29260",[88],"its own words",", \"paused\nprojects that are restored risk being broken as they won't have the legacy\nkeys\". The fix is the project's current publishable key, which begins\n",[95,411,412],{},"sb_publishable_",", in your builder's environment settings.\n",[84,415,417],{"href":416},"\u002Fblog\u002Fsupabase-new-api-keys","The two key formats"," are compared side by side.",[34,420,421,387,424,427,428,432],{},[37,422,423],{},"The table.",[95,425,426],{},"permission denied for table",". The key is fine,\nand that table has not been opened to this kind of visitor. From 30 October\n2026 a new Supabase table starts out that way, and\n",[84,429,431],{"href":430},"\u002Fblog\u002Fsupabase-permission-denied-for-table","the safe way to open it"," has an\narticle of its own.",[34,434,435,438,439,444],{},[37,436,437],{},"The session."," Signed-out pages work, signed-in people get 401s that come and\ngo, and the message usually mentions a JWT, the signed token your app holds\nfor each person who is signed in. From 14 August to 29 September 2026 Supabase's status\npage carried an incident titled\n",[84,440,443],{"href":441,"rel":442},"https:\u002F\u002Fstatus.supabase.com\u002Fincidents\u002F6q5902p2xd9f",[88],"\"401 errors due to JWT rejections\"",":\na subset of new projects rejected sessions that had just been renewed.\nSupabase's fix, released on 29 September, is a new version of the project that\nyou install yourself, with the Upgrade project button on the project's General\nsettings page.",[10,446,447,448,453,454,458],{},"That upgrade takes the project offline while it runs, and the dashboard shows\nan estimate of how long before you confirm. Supabase's\n",[84,449,452],{"href":450,"rel":451},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fplatform\u002Fupgrading",[88],"upgrade guide"," recommends\ntaking a copy of your data first. On the free plan nobody else is taking one,\nand ",[84,455,457],{"href":456},"\u002Fblog\u002Fback-up-supabase-free-tier","making one from the dashboard"," needs no\nterminal.",[23,460,462],{"id":461},"how-do-i-restart-a-supabase-project","How do I restart a Supabase project?",[10,464,465],{},"In the dashboard: open the project, go to Project Settings, then General, and\npress Restart project under Project availability. The arrow beside the button\noffers Fast database reboot, which restarts the database alone and keeps the\ndowntime shorter. Either way, Supabase warns of a few minutes offline.",[10,467,468],{},"A restart is the right tool for a project that is overloaded or marked\nunhealthy, and it is what Supabase asked affected owners to do after the\n10 September incident. If the project is too small for its work the trouble comes\nback, and the lasting fix is a larger compute size or lighter queries. A paused\nproject needs Resume project, which sits in the same place. A full database is\nstill full after a restart, and a refused key is still refused.",[10,470,471],{},"Leave the button alone during an incident that names project actions. On 4\nSeptember 2026 restarts, restores and compute changes were erroring in every\nregion, Supabase asked people not to attempt them, and for a while it switched\nthem off altogether.",[23,473,475],{"id":474},"what-can-you-do-during-a-supabase-outage","What can you do during a Supabase outage?",[10,477,478],{},"Very little, and waiting is the right call. The outage is Supabase's to fix, and\nyour project comes back without you touching it.",[10,480,481],{},"That makes an outage the one failure in this article that waiting solves, and it\nis why step 2 comes before anything you do here. You wait out a power cut. A\ndisconnection stays in place until you call the supplier, and a paused project\nstays down until you resume it, with a year on the clock from the day it\nstopped.",[63,483],{"alt":484,"caption":485,"src":486},"Two timelines. On the upper one a line drops and climbs back up by itself. On the lower one the line drops and stays down. A power button on it opens a dashed path back up, and the low line runs on to a crossed-out mark.","An outage comes back on its own. A paused project comes back when you resume it, and only within the year.","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fwait-or-act-1600x560.png",[10,488,489],{},"What is worth doing while you wait:",[212,491,492,498,504,510],{},[34,493,494,497],{},[37,495,496],{},"Confirm it is yours."," Check the incident names your region, or a service\nyour app uses.",[34,499,500,503],{},[37,501,502],{},"Subscribe to that incident",", so the update that says it is over reaches you.",[34,505,506,509],{},[37,507,508],{},"Tell your users."," One line wherever they will look for you, saying the app\nis affected by an outage at its database provider and will be back.",[34,511,512,515],{},[37,513,514],{},"Leave the project alone."," During the 4 September incident Supabase's advice\nwas \"against taking any of these actions until this incident is resolved:\nCreates, Configuration changes, Restarts, or Compute size changes\". Running\nprojects kept running while those actions failed.",[10,517,518,519,524],{},"There is also nothing to claim for the downtime unless you are on Enterprise.\nSupabase's ",[84,520,523],{"href":521,"rel":522},"https:\u002F\u002Fsupabase.com\u002Fsla",[88],"uptime commitment",", with service credits\nfor a month under 99.9%, is written for Enterprise customers alone.",[23,526,528],{"id":527},"what-to-have-in-place-before-the-next-one","What to have in place before the next one",[10,530,531],{},"Four things, all of them easier on a day when nothing is wrong:",[212,533,534,540,553,559],{},[34,535,536,539],{},[37,537,538],{},"Your region, written down"," beside your project's address, and a\nsubscription to the status page.",[34,541,542,545,546,548,549,552],{},[37,543,544],{},"Your app on the publishable key."," Supabase is retiring the legacy ",[95,547,398],{},"\nand ",[95,550,551],{},"service_role"," keys by the end of 2026, and an app still sending one will\nstart collecting 401s when they go.",[34,554,555,558],{},[37,556,557],{},"A copy of your database outside your Supabase account."," An outage, a pause\nand a restriction all happen inside Supabase, and a copy kept elsewhere is out\nof their reach. On the free plan Supabase keeps no copy for you.",[34,560,561,564],{},[37,562,563],{},"Something that notices when your app stops answering"," and tells you before\na customer has to.",[23,566,568],{"id":567},"where-reeve-fits","Where Reeve fits",[10,570,571],{},[37,572,573],{},"Reeve Monitor watches the address your visitors load. Reeve Care also connects\nto the Supabase database behind it, and keeps a copy of it outside your Supabase\naccount.",[212,575,576,582,588,594],{},[34,577,578,581],{},[37,579,580],{},"Monitor checks your app's address every 60 seconds"," from outside, and\nemails you once when it stops answering and once when it is back. It also\nre-runs all nine of our security checks every hour, on up to three apps.",[34,583,584,587],{},[37,585,586],{},"Care connects to your Supabase database itself"," to take a copy, daily on\nCare and more often on the plans above it. A night the database does not\nanswer is a copy that could not be taken, and you get an email saying what\nhappened.",[34,589,590,593],{},[37,591,592],{},"The copy lives outside your Supabase account",", encrypted, and it is read\nback before it counts, so a pause or a restriction leaves your last good copy\nwhere you can reach it.",[34,595,596,599],{},[37,597,598],{},"Restoring is a button",", and it takes a snapshot of the current state first,\nso the restore has an undo of its own.",[10,601,602,603,607,608,134],{},"What each plan covers is on the ",[84,604,606],{"href":605},"\u002Fpricing","pricing page",", and the copy, the\ncheck and the restore are drawn step by step on the\n",[84,609,611],{"href":610},"\u002Fsupabase-backups","Supabase backups page",[23,613,615],{"id":614},"what-to-do-now","What to do now",[617,618,619],"key-takeaways",{},[212,620,621,624,627,630,633,636],{},[34,622,623],{},"Find your project's region on its Infrastructure settings page, and subscribe to Supabase's status page.",[34,625,626],{},"When your app goes blank, check in order: the status page, your project list for Paused, whether pages load while saves fail, and the status codes in your browser's Network tab.",[34,628,629],{},"If the project is paused, resume it today. Waiting only uses up the year you have.",[34,631,632],{},"If requests come back 401, read the message before changing anything. A key, a table and a session each have a different fix.",[34,634,635],{},"During a real outage, leave the project alone: no restarts, restores or upgrades until the incident is resolved.",[34,637,638,639,641],{},"Move your app onto the ",[95,640,412],{}," key, and keep a copy of your database outside Supabase, while nothing is broken.",[10,643,644,645,134],{},"Before you close this tab, open your project's Infrastructure settings, write\nits region code down next to its address, and subscribe to the status page. If\ntoday's blank screen turned out to be a pause,\n",[84,646,647],{"href":132},"here is what to do next",{"title":649,"searchDepth":650,"depth":650,"links":651},"",3,[652,654,660,661,662,663,664,665],{"id":25,"depth":653,"text":26},2,{"id":73,"depth":653,"text":74,"children":655},[656,657,658,659],{"id":78,"depth":650,"text":79},{"id":125,"depth":650,"text":126},{"id":137,"depth":650,"text":138},{"id":191,"depth":650,"text":192},{"id":375,"depth":653,"text":376},{"id":461,"depth":653,"text":462},{"id":474,"depth":653,"text":475},{"id":527,"depth":653,"text":528},{"id":567,"depth":653,"text":568},{"id":614,"depth":653,"text":615},"Security basics","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcover-1200x630.png","A street of lit buildings at night, and in front of them one building with every window dark.","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.",false,"md",[673,676,679,682,684,687],{"q":674,"a":675},"Is Supabase down right now?","Check status.supabase.com, which is where Supabase reports its own incidents, service by service and region by region. Find your project's region first: it is shown on the project's Infrastructure settings page, with a code such as eu-west-1. If nothing on the status page names that region or a service your app uses, Supabase has not announced a problem, and the next place to look is your own project.",{"q":677,"a":678},"My app is broken but the Supabase status page is green. What now?","Look at your own project. Check your project list in the Supabase dashboard for the word Paused, then look for a project that is unhealthy, read-only or restricted. If all of that looks normal, open your app, press F12, choose the Network tab and reload. A request to your project that comes back 200 means Supabase answered, and the fault is on your side.",{"q":680,"a":681},"Is a paused Supabase project the same as an outage?","No, and they need opposite responses. An outage is on Supabase, and it ends when they fix it, so waiting is correct. A pause is Supabase stopping your project, most often a free one that went a week without activity, and nothing changes until you resume it from the dashboard. You have one year to do that. After it, the dashboard offers a download instead, and getting back online means a new project with a new address.",{"q":376,"a":683},"A 401 means Supabase answered and refused who was asking. Your app may be sending a key the project no longer accepts, which happens when the legacy anon key is switched off or a paused project is restored without it. A table may refuse with permission denied. Or signed-in sessions may be rejected: from 14 August to 29 September 2026 a subset of new projects did exactly that, and the fix is Upgrade project on the General settings page.",{"q":685,"a":686},"How do I restart my Supabase project?","Open the project in the Supabase dashboard and go to Project Settings, then General. Under Project availability, Restart project restarts everything, and the arrow beside it offers Fast database reboot, which restarts the database alone with less downtime. Expect a few minutes offline either way. A restart helps a project that is overloaded or unhealthy. A paused project needs Resume, on the same page, and a full database needs space.",{"q":688,"a":689},"Can I do anything during a Supabase outage?","Very little, and waiting is the right call. Confirm the incident names your region, subscribe to its updates and tell your users what they are seeing. Leave restarts, restores, upgrades and compute changes until it is resolved: in a platform-wide incident on 4 September 2026 Supabase advised against exactly those. The uptime guarantee that pays service credits covers Enterprise customers only.","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",[692,693,694,695,696,697,698,699,700],"is supabase down","supabase status","supabase outage","supabase not working","supabase down or my app","supabase 401 error","how to restart supabase project","supabase project unhealthy","my app cannot connect to supabase",{},true,"\u002Fblog\u002Fis-supabase-down-or-your-app","2026-10-01",{"title":5,"description":669},"blog\u002Fis-supabase-down-or-your-app",[708,709,710],"Is Supabase down? It might be. A paused project, a project that has hit a limit, and a fault in your own app all produce the same blank screen.","Supabase's status page answers the first question only. Your project list and your project's own pages answer the next two, and the status codes in your browser settle the last.","An outage ends without you. A paused project stays down until you resume it, and after a year the option to resume it is gone.","uhIyW9L7I2VBEaFZjuhoec263VOkZdWhqh2LP8ulPBA",[713,719,725,731,737,743,749,755,761,767,773,774,780,785,792,798,804,808,814,820,826,832,838,844,850,856,862,868,874,880,886,891,897,903,909,915,921,927,933,939,945,951,957,963,968,974,980,986,992,998,1004,1010,1016,1022,1028,1033,1038,1044,1050,1055,1061],{"path":714,"title":715,"description":716,"published":717,"category":666,"image":718,"draft":670},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":720,"title":721,"description":722,"published":723,"category":666,"image":724,"draft":670},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":726,"title":727,"description":728,"published":729,"category":666,"image":730,"draft":670},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":732,"title":733,"description":734,"published":735,"category":666,"image":736,"draft":670},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":738,"title":739,"description":740,"published":741,"category":666,"image":742,"draft":670},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":744,"title":745,"description":746,"published":747,"category":666,"image":748,"draft":670},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":750,"title":751,"description":752,"published":753,"category":666,"image":754,"draft":670},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":756,"title":757,"description":758,"published":759,"category":666,"image":760,"draft":670},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":762,"title":763,"description":764,"published":765,"category":666,"image":766,"draft":670},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":768,"title":769,"description":770,"published":771,"category":666,"image":772,"draft":670},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":703,"title":5,"description":669,"published":704,"category":666,"image":690,"draft":670},{"path":775,"title":776,"description":777,"published":778,"category":666,"image":779,"draft":670},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":154,"title":781,"description":782,"published":783,"category":666,"image":784,"draft":670},"Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":786,"title":787,"description":788,"published":789,"category":790,"image":791,"draft":670},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","Backups","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":793,"title":794,"description":795,"published":796,"category":790,"image":797,"draft":670},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":799,"title":800,"description":801,"published":802,"category":790,"image":803,"draft":670},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":430,"title":805,"description":806,"published":802,"category":666,"image":807,"draft":670},"Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":809,"title":810,"description":811,"published":812,"category":666,"image":813,"draft":670},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":815,"title":816,"description":817,"published":818,"category":666,"image":819,"draft":670},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":821,"title":822,"description":823,"published":824,"category":790,"image":825,"draft":670},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":827,"title":828,"description":829,"published":830,"category":666,"image":831,"draft":670},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":833,"title":834,"description":835,"published":836,"category":666,"image":837,"draft":670},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":839,"title":840,"description":841,"published":842,"category":666,"image":843,"draft":670},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":845,"title":846,"description":847,"published":848,"category":666,"image":849,"draft":670},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":851,"title":852,"description":853,"published":854,"category":666,"image":855,"draft":670},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":857,"title":858,"description":859,"published":860,"category":666,"image":861,"draft":670},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":863,"title":864,"description":865,"published":866,"category":666,"image":867,"draft":670},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":869,"title":870,"description":871,"published":872,"category":666,"image":873,"draft":670},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":875,"title":876,"description":877,"published":878,"category":790,"image":879,"draft":670},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":881,"title":882,"description":883,"published":884,"category":790,"image":885,"draft":670},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":132,"title":887,"description":888,"published":889,"category":790,"image":890,"draft":670},"Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":892,"title":893,"description":894,"published":895,"category":666,"image":896,"draft":670},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":898,"title":899,"description":900,"published":901,"category":666,"image":902,"draft":670},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":904,"title":905,"description":906,"published":907,"category":666,"image":908,"draft":670},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":910,"title":911,"description":912,"published":913,"category":666,"image":914,"draft":670},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":916,"title":917,"description":918,"published":919,"category":666,"image":920,"draft":670},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Ten tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":922,"title":923,"description":924,"published":925,"category":666,"image":926,"draft":670},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":928,"title":929,"description":930,"published":931,"category":666,"image":932,"draft":670},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":934,"title":935,"description":936,"published":937,"category":666,"image":938,"draft":670},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":940,"title":941,"description":942,"published":943,"category":666,"image":944,"draft":670},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":946,"title":947,"description":948,"published":949,"category":666,"image":950,"draft":670},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":952,"title":953,"description":954,"published":955,"category":790,"image":956,"draft":670},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":958,"title":959,"description":960,"published":961,"category":666,"image":962,"draft":670},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":456,"title":964,"description":965,"published":966,"category":790,"image":967,"draft":670},"Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":969,"title":970,"description":971,"published":972,"category":666,"image":973,"draft":670},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":975,"title":976,"description":977,"published":978,"category":666,"image":979,"draft":670},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":981,"title":982,"description":983,"published":984,"category":666,"image":985,"draft":670},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":987,"title":988,"description":989,"published":990,"category":666,"image":991,"draft":670},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":993,"title":994,"description":995,"published":996,"category":790,"image":997,"draft":670},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":999,"title":1000,"description":1001,"published":1002,"category":790,"image":1003,"draft":670},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1005,"title":1006,"description":1007,"published":1008,"category":666,"image":1009,"draft":670},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1011,"title":1012,"description":1013,"published":1014,"category":666,"image":1015,"draft":670},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1017,"title":1018,"description":1019,"published":1020,"category":790,"image":1021,"draft":670},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1023,"title":1024,"description":1025,"published":1026,"category":666,"image":1027,"draft":670},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1029,"title":1030,"description":1031,"published":1026,"category":666,"image":1032,"draft":670},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":416,"title":1034,"description":1035,"published":1036,"category":666,"image":1037,"draft":670},"Supabase's new API keys: which one is safe in your app?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1039,"title":1040,"description":1041,"published":1042,"category":790,"image":1043,"draft":670},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1045,"title":1046,"description":1047,"published":1048,"category":666,"image":1049,"draft":670},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1051,"title":1052,"description":1053,"published":1048,"category":790,"image":1054,"draft":670},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1056,"title":1057,"description":1058,"published":1059,"category":790,"image":1060,"draft":670},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1062,"title":1063,"description":1064,"published":1059,"category":666,"image":1065,"draft":670},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1791705957970]