[{"data":1,"prerenderedAt":1336},["ShallowReactive",2],{"blog-en-null-value-violates-not-null-constraint":3,"blog-index-en":810},{"id":4,"title":5,"body":6,"category":768,"cover":769,"coverAlt":770,"description":771,"draft":772,"extension":773,"faq":774,"image":790,"keywords":791,"meta":799,"navigation":800,"ogTitle":5,"path":801,"published":802,"seo":803,"stem":804,"tldr":805,"updated":802,"__hash__":809},"blog_en\u002Fblog\u002Fnull-value-violates-not-null-constraint.md","\"null value in column violates not-null constraint\" in Supabase",{"type":7,"value":8,"toc":756},"minimark",[9,13,24,35,38,43,46,49,171,180,184,187,201,216,241,258,293,308,312,321,350,367,375,381,387,394,400,404,407,420,426,429,435,443,448,452,455,463,474,484,490,496,514,545,549,552,563,570,573,597,615,618,624,627,633,640,645,649,652,661,683,692,706,710,749],[10,11,12],"p",{},"You press Save on a new task in your app and nothing is saved. The page shows\nno error and the list stays as it was. The browser console has the reason:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","{\n  \"code\": \"23502\",\n  \"details\": null,\n  \"hint\": null,\n  \"message\": \"null value in column \\\"category_id\\\" of relation \\\"tasks\\\" violates not-null constraint\"\n}\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26,27,30,31,34],{},"Supabase \"null value in column violates not-null constraint\" means a row reached\nyour database with nothing in a column that must always hold a value, and\nPostgres refused the whole row. Here the column is ",[21,28,29],{},"category_id"," in your ",[21,32,33],{},"tasks","\ntable. The save sent no category.",[10,36,37],{},"The quickest fix is to remove the rule: one line of SQL that lets the column stay\nempty. The error goes away, and rows start arriving\nwith that box blank, which the rest of your app then meets somewhere you were not\nlooking. Find out where the empty value came from first. It is nearly always one\nof a few places.",[39,40,42],"h2",{"id":41},"what-does-null-value-in-column-violates-not-null-constraint-mean","What does \"null value in column violates not-null constraint\" mean?",[10,44,45],{},"It means one column of the row your app tried to save was empty, that column is\nmarked as one that may never be empty, and Postgres refused to save any of the\nrow. Nothing was written. Null is Postgres's word for no value at all, which is\ndifferent from a zero or from text with no letters in it.",[10,47,48],{},"Think of each row as a paper form and the table as the filing drawer it goes\ninto. A not-null constraint is a star printed beside one box. Postgres is the\nclerk at the drawer, and the clerk files nothing with a starred box left blank.\nThe form comes back, and the message says which box.",[50,51,52,68],"table",{},[53,54,55],"thead",{},[56,57,58,62,65],"tr",{},[59,60,61],"th",{},"Field",[59,63,64],{},"Example",[59,66,67],{},"What it tells you",[69,70,71,97,112,131,145],"tbody",{},[56,72,73,78,83],{},[74,75,76],"td",{},[21,77,21],{},[74,79,80],{},[21,81,82],{},"23502",[74,84,85,86,89,90],{},"Postgres's code for this error, named ",[21,87,88],{},"not_null_violation"," in ",[91,92,96],"a",{"href":93,"rel":94},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Futils\u002Ferrcodes.txt",[95],"nofollow","its list of codes",[56,98,99,104,109],{},[74,100,101],{},[21,102,103],{},"message",[74,105,106],{},[21,107,108],{},"null value in column \"category_id\" of relation \"tasks\" violates not-null constraint",[74,110,111],{},"The empty column, then the table. \"Relation\" is Postgres's word for a table",[56,113,114,119,128],{},[74,115,116],{},[21,117,118],{},"details",[74,120,121,124,125],{},[21,122,123],{},"Failing row contains (…)",", or ",[21,126,127],{},"null",[74,129,130],{},"A copy of the refused row, when Postgres decides the caller may see it. A section further down covers when that is",[56,132,133,138,142],{},[74,134,135],{},[21,136,137],{},"hint",[74,139,140],{},[21,141,127],{},[74,143,144],{},"Nothing to add for this error",[56,146,147,150,155],{},[74,148,149],{},"HTTP status",[74,151,152],{},[21,153,154],{},"400 Bad Request",[74,156,157,158,161,162,164,165,170],{},"PostgREST, the part of Supabase that turns ",[21,159,160],{},"supabase.from(...)"," calls into SQL, has no special case for ",[21,163,82],{},", so ",[91,166,169],{"href":167,"rel":168},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fblob\u002Fmain\u002Fsrc\u002Flibrary\u002FPostgREST\u002FError.hs",[95],"its code"," falls through to 400",[10,172,173,174,179],{},"The wording is Postgres's own, from\n",[91,175,178],{"href":176,"rel":177},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Fexecutor\u002FexecMain.c",[95],"the function that raises it",",\nand it reads the same whether the row came from your app, a trigger or the SQL\nEditor.",[39,181,183],{"id":182},"where-did-the-empty-value-come-from","Where did the empty value come from?",[10,185,186],{},"Usually from one of three places in your app's own code, and the column in the\nmessage tells you which to look at first. Two more start inside the database.",[10,188,189,193,194,196,197,200],{},[190,191,192],"strong",{},"A field your app never sends."," This is the commonest. The column became\nrequired after the form was built: an AI builder added ",[21,195,29],{}," to the\ntable when you asked for categories, marked it required, and left the form that\nsaves tasks as it was. Nothing in the request names the column, the column has no\ndefault, so it is empty. Compare the columns in your Table Editor with the object\nyour app passes to ",[21,198,199],{},".insert()",". The missing one is the one in the message.",[10,202,203,204,207,208,210,211,215],{},"A key spelled differently from its column never gets this far. PostgREST refuses\n",[21,205,206],{},"categoryId"," sent to a column called ",[21,209,29],{}," before Postgres sees the row,\nand ",[91,212,214],{"href":213},"\u002Fblog\u002Fsupabase-schema-cache-column-error","that error has a post of its own",".",[10,217,218,221,222,225,226,229,230,237,238,240],{},[190,219,220],{},"A null your code sends on purpose."," ",[21,223,224],{},"{ category_id: selected?.id ?? null }","\nsends an explicit null when nothing is selected, and an explicit null is a value\nas far as the request is concerned. JavaScript's ",[21,227,228],{},"undefined"," behaves\ndifferently. JSON has no such value, so\n",[91,231,234],{"href":232,"rel":233},"https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FJavaScript\u002FReference\u002FGlobal_Objects\u002FJSON\u002Fstringify",[95],[21,235,236],{},"JSON.stringify","\nleaves it \"omitted (when found in an object)\", and a key set to ",[21,239,228],{}," never\nreaches Supabase at all. Which of the two your code produces decides whether a\ndefault can step in, and the next section is about that.",[10,242,243,221,246,249,250,253,254,257],{},[190,244,245],{},"A column with no default where you assumed one.",[21,247,248],{},"created_at"," usually fills\nitself in, because the table says ",[21,251,252],{},"default now()",". ",[21,255,256],{},"user_id"," usually does not,\nbecause nothing in Postgres knows who is signed in unless the column is told how\nto find out. A later section shows how.",[10,259,260,263,264,267,268,271,272,277,278,281,282,284,285,289,290,292],{},[190,261,262],{},"A sign-up, under another message."," A trigger that copies each new user into a\n",[21,265,266],{},"profiles"," table reads their sign-up details with ",[21,269,270],{},"->>",", and\n",[91,273,276],{"href":274,"rel":275},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Ffunctions-json.html",[95],"Postgres's JSON operators","\n\"return NULL, rather than failing, if the JSON input does not have the right\nstructure to match the request; for example if no such key or array element\nexists\". A sign-up form that never sent ",[21,279,280],{},"full_name"," hands the trigger an empty\nname, a required ",[21,283,280],{}," column refuses it, and Supabase reports the whole\nsign-up as ",[91,286,288],{"href":287},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\"",".\nThe ",[21,291,82],{}," itself is in the Postgres logs, and that post shows where.",[10,294,295,298,299,302,303,307],{},[190,296,297],{},"A delete somewhere else."," A foreign key set to ",[21,300,301],{},"on delete set null"," empties\nthe column in every row that pointed at the deleted one. If that column is also\nrequired, the delete fails with this message instead, and\n",[91,304,306],{"href":305},"\u002Fblog\u002Fdatabase-error-deleting-user","the post on deleting users"," covers choosing a\nrule that fits.",[39,309,311],{"id":310},"but-the-column-has-a-default","\"But the column has a default\"",[10,313,314,315,320],{},"Then the request named the column and sent it empty. Postgres fills in a default\nonly when a column is left out of the row entirely.\n",[91,316,319],{"href":317,"rel":318},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fddl-default.html",[95],"Its documentation on defaults","\nsays: \"When a new row is created and no values are specified for some of the\ncolumns, those columns will be filled with their respective default values.\" An\nexplicit null counts as a value specified. On the form, a box with a value\nprinted in it counts as filled until somebody writes \"none\" over the print.",[10,322,323,324,329,330,333,334,336,337,340,341,346,347,349],{},"supabase-js writes \"none\" over it in one place you would not expect: a bulk\ninsert, where you pass an array of rows. It names every column that appears in\nany of the rows, and\n",[91,325,328],{"href":326,"rel":327},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase-js\u002Fblob\u002Fmaster\u002Fpackages\u002Fcore\u002Fpostgrest-js\u002Fsrc\u002FPostgrestQueryBuilder.ts",[95],"its source","\ndocuments the option that decides what happens to the gaps, ",[21,331,332],{},"defaultToNull",":\n\"Make missing fields default to ",[21,335,127],{},". Otherwise, use the default value for the\ncolumn. Only applies for bulk inserts.\" It is ",[21,338,339],{},"true"," unless you change it.\n",[91,342,345],{"href":343,"rel":344},"https:\u002F\u002Fdocs.postgrest.org\u002Fen\u002Fstable\u002Freferences\u002Fapi\u002Fpreferences.html",[95],"PostgREST's documentation","\nsays the same for a request that lists its columns, which is what supabase-js\nsends for an array: \"any missing columns in the payload will be inserted as\n",[21,348,127],{}," value by default.\"",[10,351,352,353,356,357,359,360,363,364,366],{},"So here the second task goes in with ",[21,354,355],{},"status"," empty, even if the table says\n",[21,358,355],{}," defaults to ",[21,361,362],{},"'todo'",", and a required ",[21,365,355],{}," refuses the whole insert:",[14,368,373],{"className":369,"code":371,"language":372,"meta":23},[370],"language-js","await supabase.from('tasks').insert([\n  { title: 'Write the brief', status: 'doing' },\n  { title: 'Send the invoice' },\n])\n","js",[21,374,371],{"__ignoreMap":23},[10,376,377,378,380],{},"Either repair works. Send ",[21,379,355],{}," in every row, or tell supabase-js to let the\ntable's defaults stand:",[14,382,385],{"className":383,"code":384,"language":372,"meta":23},[370],"await supabase.from('tasks').insert(rows, { defaultToNull: false })\n",[21,386,384],{"__ignoreMap":23},[10,388,389,390,393],{},"That option adds the ",[21,391,392],{},"Prefer: missing=default"," header PostgREST reads. A single\nrow passed as an object, without the array around it, does not do this: a key\nleft out of it is left out of the insert, and the default applies.",[395,396],"diagram",{"alt":397,"caption":398,"src":399},"The same two-row insert drawn twice. The second form leaves out its starred status box. On the left, under defaultToNull: true, that box reads null in amber over its printed default and the insert ends at 23502. On the right, under defaultToNull: false, the printed default shows through and the insert is ticked.","In a bulk insert, a column one row has and another lacks goes in as null for the row that lacks it. defaultToNull: false lets the table's default fill it instead.","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fnull-over-the-default-1600x720.png",[39,401,403],{"id":402},"why-does-an-upsert-fail-with-this-when-the-row-already-exists","Why does an upsert fail with this when the row already exists?",[10,405,406],{},"Because Postgres checks the new row for empty required columns before it looks\nfor the existing row it would update. An upsert is a form marked \"file this, or\nif there is already a file for this person, change it\". The clerk checks the\nstars first. A form carrying only a new profile picture comes back, even though\nthe file it was meant to change is sitting in the drawer.",[10,408,409,410,415,416,419],{},"The order is written into\n",[91,411,414],{"href":412,"rel":413},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Fexecutor\u002FnodeModifyTable.c",[95],"the code that runs an insert",":\n\"Check the constraints of the tuple.\" comes before \"Perform a speculative\ninsertion.\", which is the step that finds the clash an ",[21,417,418],{},"on conflict"," clause acts\non. Tuple is Postgres's word for a row. So this upsert, meant to change one\ncolumn of a profile that exists, fails on any other column the table requires:",[14,421,424],{"className":422,"code":423,"language":372,"meta":23},[370],"await supabase.from('profiles').upsert({ id: user.id, avatar_url: url })\n",[21,425,423],{"__ignoreMap":23},[10,427,428],{},"To change some columns of a row that is already there, use an update. It lands\non the stored row, which has every required column filled, and changes only what\nyou send:",[14,430,433],{"className":431,"code":432,"language":372,"meta":23},[370],"await supabase.from('profiles').update({ avatar_url: url }).eq('id', user.id)\n",[21,434,432],{"__ignoreMap":23},[10,436,437,438,442],{},"Keep upsert for rows that might not exist yet, and send every required column\nwith it. ",[91,439,441],{"href":440},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","The post on duplicate keys","\ncovers the rest of what an upsert needs: which column it matches on, and the\nread rules it calls on from the browser.",[395,444],{"alt":445,"caption":446,"src":447},"Two lanes starting from the same one-box change. In the upsert lane it becomes a new row whose starred second box is empty, a starred gate shuts in amber with 23502 under it, and the on conflict gate and the drawer beyond it are never reached. In the update lane it lands on the stored row with every starred box filled, the gate is open, and the drawer takes it.","An upsert's row is checked for empty required columns before Postgres looks for the row it would update. An update starts from the stored row, which already has them.","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fupsert-is-checked-first-1600x780.png",[39,449,451],{"id":450},"should-you-drop-the-not-null-rule","Should you drop the NOT NULL rule?",[10,453,454],{},"Only if the column was never meant to be required. A phone number your form\ntreats as optional is that case, and dropping the rule there is the right repair:",[14,456,461],{"className":457,"code":459,"language":460,"meta":23},[458],"language-sql","alter table public.profiles alter column phone drop not null;\n","sql",[21,462,459],{"__ignoreMap":23},[10,464,465,466,469,470,473],{},"For any other column, keep the rule and fill the box. Without it, every row saved\nafterwards can lack the value the rule was guaranteeing, and your app meets the\ngap somewhere else: a page that reads ",[21,467,468],{},"task.category.name"," stops with\n",[21,471,472],{},"Cannot read properties of null",", or a count of tasks per category quietly loses\nthe ones with none.",[10,475,476,477,479,480,483],{},"The column where dropping it costs most is ",[21,478,256],{},". A row saved with an empty\nowner is shown to nobody. A read rule written as ",[21,481,482],{},"auth.uid() = user_id"," never\nmatches it, because in SQL an empty value equals nothing, another empty value\nincluded. The task is saved, and from then on nobody sees it, the person who\ncreated it included.",[10,485,486,487,489],{},"The repair for ",[21,488,256],{}," is a default that fills in whoever is signed in:",[14,491,494],{"className":492,"code":493,"language":460,"meta":23},[458],"alter table public.tasks\n  alter column user_id set default auth.uid();\n",[21,495,493],{"__ignoreMap":23},[10,497,498,499,503,504,507,508,513],{},"Postgres evaluates a default \"whenever the default value is inserted (not when\nthe table is created)\", in\n",[91,500,502],{"href":317,"rel":501},[95],"its own words",", so\neach new row gets the id of the person saving it. With nobody signed in,\n",[21,505,506],{},"auth.uid()"," returns null, as\n",[91,509,512],{"href":510,"rel":511},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fpostgres\u002Frow-level-security",[95],"Supabase's guide to row level security","\nwarns, and the save still fails. That is the rule doing its job. The default\nfills the box only when your app leaves it out, so what stops somebody sending\nanother person's id is still your insert rule.",[10,515,516,517,521,522,524,525,527,528,530,531,535,536,538,539,541,542,544],{},"That insert rule also changes which message you see. Postgres runs a table's Row\nLevel Security checks on a new row before its not-null checks:\n",[91,518,520],{"href":412,"rel":519},[95],"the same insert code","\nhas \"Check any RLS WITH CHECK policies.\" ahead of \"Check the constraints of the\ntuple.\". So when your insert rule compares ",[21,523,256],{}," with ",[21,526,506],{},", an empty\n",[21,529,256],{}," fails the rule first and comes back as\n",[91,532,534],{"href":533},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","new row violates row-level security policy",".\nA ",[21,537,82],{}," on ",[21,540,256],{}," from your app means one of three things: the insert rule\nnever looks at ",[21,543,256],{},", the rules are off on that table, or the request came\nfrom server code that skips them.",[39,546,548],{"id":547},"is-it-safe-to-show-this-error-to-your-users","Is it safe to show this error to your users?",[10,550,551],{},"No. Show a sentence of your own and keep the raw error in your logs, because the\ndetail line, when Postgres includes it, is a copy of the whole row.",[10,553,554,555,559,560,562],{},"A duplicate key's detail line repeats one value. This one repeats the form.\n",[91,556,558],{"href":176,"rel":557},[95],"The function that writes it","\nprints the row as ",[21,561,123],{},", with every column the caller is\nallowed to read. On an update, that is the row as it would have been saved,\nincluding the columns nobody touched. A form the clerk sends back can come with a\nphotocopy of itself stapled to the refusal, and the copy shows every box.",[10,564,565,566,569],{},"Postgres decides who gets the photocopy, and its code checks first: \"Check if RLS\nis enabled and should be active for the relation; if so, then don't return\nanything.\" A request made with your public key to a table with Row Level\nSecurity on gets ",[21,567,568],{},"\"details\": null",", which is what the console at the top of this\npage showed.",[10,571,572],{},"Two callers get the full copy.",[10,574,575,578,579,582,583,586,587,591,592,596],{},[190,576,577],{},"A browser, when the table's rules are off."," If the console shows\n",[21,580,581],{},"Failing row contains"," for a request your app made with the public key, Row\nLevel Security is off on that table. That is the same reading\n",[91,584,585],{"href":440},"the duplicate-key post","\ngives its own detail line, and\n",[91,588,590],{"href":589},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","turning the rules on for every table","\ncovers the switch and the first rule. A table with its rules off hands rows to a\nstranger as readily as to you. Our ",[91,593,595],{"href":594},"\u002Fsecurity-scanner","free scan"," reads your live\napp with the public key any visitor gets and lists the tables that hand rows\nback. It needs no account.",[10,598,599,602,603,606,607,610,611,614],{},[190,600,601],{},"Server code holding the secret key."," Supabase's guide says the secret key\n\"authorizes access through the ",[21,604,605],{},"service_role"," Postgres role, which has the\n",[21,608,609],{},"bypassrls"," attribute\", so the rules never apply and the detail line is always\nfilled in. An Edge Function that updates a row and answers with the error it got,\n",[21,612,613],{},"return new Response(JSON.stringify(error))",", sends the browser every column of\nthe row it was changing, whoever that row belongs to.",[10,616,617],{},"In server code, keep the error and answer with your own words:",[14,619,622],{"className":620,"code":621,"language":372,"meta":23},[370],"if (error) {\n  console.error(error)\n  return new Response(JSON.stringify({ message: 'That could not be saved.' }), {\n    status: 400,\n  })\n}\n",[21,623,621],{"__ignoreMap":23},[10,625,626],{},"In the app, catch the code and say what the person can do about it:",[14,628,631],{"className":629,"code":630,"language":372,"meta":23},[370],"const { error } = await supabase.from('tasks').insert(task)\n\nif (error?.code === '23502') {\n  setMessage('Pick a category before you save.')\n} else if (error) {\n  setMessage('Something went wrong. Please try again.')\n}\n",[21,632,630],{"__ignoreMap":23},[10,634,635,639],{},[91,636,638],{"href":637},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Moving a secret key into an Edge Function","\ncovers the function half of this, if the secret key is still in your app.",[395,641],{"alt":642,"caption":643,"src":644},"The same refused row sent twice into the same drawer. On the left, from a browser window, the drawer carries a padlock and the answer reads code 23502, 400 and details null. On the right, from a function holding a key, the drawer has no padlock and the answer's details line, Failing row contains, is amber, with a row of amber bars under it for every column.","With Row Level Security on, the browser gets no copy of the row. Server code holding the secret key gets all of it, and passes it on if it returns the error as it came.","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fthe-whole-row-comes-back-1600x760.png",[39,646,648],{"id":647},"before-you-change-a-columns-rules","Before you change a column's rules",[10,650,651],{},"Keep a copy of the database from before you add a default, drop a rule or fill\nin a value across every row, and hear about it when a table starts answering\nstrangers.",[10,653,654],{},[190,655,656,660],{},[91,657,659],{"href":658},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database:",[662,663,664,668,671,674,677,680],"ul",{},[665,666,667],"li",{},"an encrypted copy on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[665,669,670],{},"every row as it was before an update across the whole table rewrote it",[665,672,673],{},"each copy verified before it counts, by counting the rows in every table",[665,675,676],{},"your uploaded files as well, once you connect a Storage credential",[665,678,679],{},"a one-click restore, with a safety copy of the current state taken first",[665,681,682],{},"everything Monitor does",[10,684,685],{},[190,686,687,691],{},[91,688,690],{"href":689},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking from outside:",[662,693,694,697,700,703],{},[665,695,696],{},"whether your app is up, checked every minute",[665,698,699],{},"the full security check every hour, on up to three apps",[665,701,702],{},"an email the day a re-scan grades your app lower than the one before, so a table whose rules were switched off reaches you without you going to look",[665,704,705],{},"a monthly report, in plain language, of what it saw",[39,707,709],{"id":708},"what-to-do-now","What to do now",[711,712,713],"key-takeaways",{},[662,714,715,718,724,731,738,746],{},[665,716,717],{},"Read the column and the table in the message. That is the box that arrived empty.",[665,719,720,721,723],{},"Check whether your app leaves that field out, sends it as ",[21,722,127],{},", or expects a default the column does not have.",[665,725,726,727,730],{},"To change some columns of a row that exists, use ",[21,728,729],{},".update()"," with a filter. An upsert has to carry every required column.",[665,732,733,734,737],{},"In a bulk insert, send every column in every row, or pass ",[21,735,736],{},"{ defaultToNull: false }"," so the table's defaults stand.",[665,739,740,741,743,744,215],{},"Keep the rule on ",[21,742,256],{}," and give the column the default ",[21,745,506],{},[665,747,748],{},"From server code, log the raw error and answer the browser with a sentence of your own.",[10,750,751,752,755],{},"Start with the column in the message, then the line of your code that builds the\nrow. If the repair changes the table itself, a new default or an update across\nevery row, ",[91,753,754],{"href":658},"keep a copy of the database"," from before you run\nit.",{"title":23,"searchDepth":757,"depth":757,"links":758},3,[759,761,762,763,764,765,766,767],{"id":41,"depth":760,"text":42},2,{"id":182,"depth":760,"text":183},{"id":310,"depth":760,"text":311},{"id":402,"depth":760,"text":403},{"id":450,"depth":760,"text":451},{"id":547,"depth":760,"text":548},{"id":647,"depth":760,"text":648},{"id":708,"depth":760,"text":709},"Security basics","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcover-1200x630.png","A paper form held in front of an open filing drawer, its second starred box empty and outlined in amber.","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.",false,"md",[775,778,781,784,787],{"q":776,"a":777},"What does null value in column violates not-null constraint mean?","It means your app tried to save a row with no value in a column that must always have one, and Postgres refused the whole row. Nothing was written. The message names the column and the table. The code is 23502, and from a Supabase app it arrives as HTTP 400.",{"q":779,"a":780},"Why is the column null when it has a default?","Because the request named the column and sent it empty. Postgres fills in a default only when the column is left out. supabase-js does exactly this in a bulk insert: a column that one row has and another lacks goes in as null for the row that lacks it, unless you pass defaultToNull: false.",{"q":782,"a":783},"Why does my upsert fail with a not-null error when the row exists?","Postgres checks the new row for empty required columns before it looks for the existing row to update. An upsert carrying only the columns you want to change fails on any other required column. For a row that already exists, use update with a filter.",{"q":785,"a":786},"Should I drop the NOT NULL constraint?","Only if the column was never meant to be required, such as a phone number your form treats as optional. Otherwise the error stops and rows start arriving without the value, which your app meets somewhere else. A row with an empty user_id is shown to nobody. Find where the null comes from, or give the column a default such as auth.uid().",{"q":788,"a":789},"Is it safe to show this error to users?","No. When Postgres includes the detail line, it is a copy of the whole row. A browser request to a table with Row Level Security on gets none, but server code using the secret key always does. Catch code 23502, show a sentence you wrote, and keep the raw error in your logs.","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",[792,793,794,795,796,797,798],"null value in column violates not-null constraint","supabase not null constraint error","postgres 23502","failing row contains","supabase upsert not null","null value in column user_id violates not-null constraint","supabase defaulttonull",{},true,"\u002Fblog\u002Fnull-value-violates-not-null-constraint","2026-11-06",{"title":5,"description":771},"blog\u002Fnull-value-violates-not-null-constraint",[806,807,808],"Supabase \"null value in column violates not-null constraint\" (Postgres code 23502, HTTP 400 in your app) means a row arrived with nothing in a column that must always hold a value. The message names the column and the table. Nothing was saved.","The empty value comes from a field your app never sends, a null your code sends on purpose, or a column with no default where you assumed one. An upsert and a bulk insert can each produce it on a row that looks complete.","Keep the rule and fix the row. From server code, never pass the raw error back to the browser: its \"Failing row contains\" line can print the whole row.","oG09Kw6fDrvYfXHMPNnBPFs7c17Qm5IlepwGP-d92aQ",[811,817,823,829,830,836,842,848,854,860,866,872,878,884,890,896,902,907,913,919,924,930,936,942,948,954,960,965,971,977,983,989,995,1001,1007,1013,1018,1024,1030,1036,1042,1048,1054,1060,1066,1072,1077,1083,1089,1095,1101,1107,1113,1119,1125,1131,1137,1143,1149,1155,1161,1167,1172,1178,1184,1190,1196,1202,1208,1214,1220,1226,1232,1238,1244,1250,1255,1261,1267,1273,1279,1285,1291,1297,1302,1308,1314,1320,1325,1331],{"path":812,"title":813,"description":814,"published":815,"category":768,"image":816,"draft":772},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":818,"title":819,"description":820,"published":821,"category":768,"image":822,"draft":772},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":824,"title":825,"description":826,"published":827,"category":768,"image":828,"draft":772},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":801,"title":5,"description":771,"published":802,"category":768,"image":790,"draft":772},{"path":831,"title":832,"description":833,"published":834,"category":768,"image":835,"draft":772},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":837,"title":838,"description":839,"published":840,"category":768,"image":841,"draft":772},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":843,"title":844,"description":845,"published":846,"category":768,"image":847,"draft":772},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":849,"title":850,"description":851,"published":852,"category":768,"image":853,"draft":772},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":855,"title":856,"description":857,"published":858,"category":768,"image":859,"draft":772},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":861,"title":862,"description":863,"published":864,"category":768,"image":865,"draft":772},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":305,"title":867,"description":868,"published":869,"category":870,"image":871,"draft":772},"\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":873,"title":874,"description":875,"published":876,"category":768,"image":877,"draft":772},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":879,"title":880,"description":881,"published":882,"category":768,"image":883,"draft":772},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":885,"title":886,"description":887,"published":888,"category":768,"image":889,"draft":772},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":891,"title":892,"description":893,"published":894,"category":768,"image":895,"draft":772},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":897,"title":898,"description":899,"published":900,"category":768,"image":901,"draft":772},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":440,"title":903,"description":904,"published":905,"category":768,"image":906,"draft":772},"Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":908,"title":909,"description":910,"published":911,"category":768,"image":912,"draft":772},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":914,"title":915,"description":916,"published":917,"category":768,"image":918,"draft":772},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":213,"title":920,"description":921,"published":922,"category":768,"image":923,"draft":772},"Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":925,"title":926,"description":927,"published":928,"category":768,"image":929,"draft":772},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":931,"title":932,"description":933,"published":934,"category":768,"image":935,"draft":772},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":937,"title":938,"description":939,"published":940,"category":768,"image":941,"draft":772},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":943,"title":944,"description":945,"published":946,"category":768,"image":947,"draft":772},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":949,"title":950,"description":951,"published":952,"category":768,"image":953,"draft":772},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":955,"title":956,"description":957,"published":958,"category":768,"image":959,"draft":772},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":287,"title":961,"description":962,"published":963,"category":768,"image":964,"draft":772},"\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":966,"title":967,"description":968,"published":969,"category":768,"image":970,"draft":772},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":972,"title":973,"description":974,"published":975,"category":768,"image":976,"draft":772},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":978,"title":979,"description":980,"published":981,"category":768,"image":982,"draft":772},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":984,"title":985,"description":986,"published":987,"category":768,"image":988,"draft":772},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":990,"title":991,"description":992,"published":993,"category":768,"image":994,"draft":772},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":996,"title":997,"description":998,"published":999,"category":768,"image":1000,"draft":772},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":1002,"title":1003,"description":1004,"published":1005,"category":768,"image":1006,"draft":772},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":1008,"title":1009,"description":1010,"published":1011,"category":768,"image":1012,"draft":772},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":637,"title":1014,"description":1015,"published":1016,"category":768,"image":1017,"draft":772},"Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":1019,"title":1020,"description":1021,"published":1022,"category":768,"image":1023,"draft":772},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":1025,"title":1026,"description":1027,"published":1028,"category":768,"image":1029,"draft":772},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":1031,"title":1032,"description":1033,"published":1034,"category":768,"image":1035,"draft":772},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":1037,"title":1038,"description":1039,"published":1040,"category":768,"image":1041,"draft":772},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":1043,"title":1044,"description":1045,"published":1046,"category":768,"image":1047,"draft":772},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":1049,"title":1050,"description":1051,"published":1052,"category":768,"image":1053,"draft":772},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":1055,"title":1056,"description":1057,"published":1058,"category":870,"image":1059,"draft":772},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":1061,"title":1062,"description":1063,"published":1064,"category":870,"image":1065,"draft":772},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":1067,"title":1068,"description":1069,"published":1070,"category":870,"image":1071,"draft":772},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":1073,"title":1074,"description":1075,"published":1070,"category":768,"image":1076,"draft":772},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":1078,"title":1079,"description":1080,"published":1081,"category":768,"image":1082,"draft":772},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":1084,"title":1085,"description":1086,"published":1087,"category":768,"image":1088,"draft":772},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":1090,"title":1091,"description":1092,"published":1093,"category":870,"image":1094,"draft":772},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":1096,"title":1097,"description":1098,"published":1099,"category":768,"image":1100,"draft":772},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":1102,"title":1103,"description":1104,"published":1105,"category":768,"image":1106,"draft":772},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":1108,"title":1109,"description":1110,"published":1111,"category":768,"image":1112,"draft":772},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":1114,"title":1115,"description":1116,"published":1117,"category":768,"image":1118,"draft":772},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":1120,"title":1121,"description":1122,"published":1123,"category":768,"image":1124,"draft":772},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":1126,"title":1127,"description":1128,"published":1129,"category":768,"image":1130,"draft":772},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1132,"title":1133,"description":1134,"published":1135,"category":768,"image":1136,"draft":772},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1138,"title":1139,"description":1140,"published":1141,"category":768,"image":1142,"draft":772},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1144,"title":1145,"description":1146,"published":1147,"category":870,"image":1148,"draft":772},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1150,"title":1151,"description":1152,"published":1153,"category":870,"image":1154,"draft":772},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1156,"title":1157,"description":1158,"published":1159,"category":870,"image":1160,"draft":772},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1162,"title":1163,"description":1164,"published":1165,"category":768,"image":1166,"draft":772},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":589,"title":1168,"description":1169,"published":1170,"category":768,"image":1171,"draft":772},"Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1173,"title":1174,"description":1175,"published":1176,"category":768,"image":1177,"draft":772},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1179,"title":1180,"description":1181,"published":1182,"category":768,"image":1183,"draft":772},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1185,"title":1186,"description":1187,"published":1188,"category":768,"image":1189,"draft":772},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1191,"title":1192,"description":1193,"published":1194,"category":768,"image":1195,"draft":772},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1197,"title":1198,"description":1199,"published":1200,"category":768,"image":1201,"draft":772},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1203,"title":1204,"description":1205,"published":1206,"category":768,"image":1207,"draft":772},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1209,"title":1210,"description":1211,"published":1212,"category":768,"image":1213,"draft":772},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1215,"title":1216,"description":1217,"published":1218,"category":768,"image":1219,"draft":772},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1221,"title":1222,"description":1223,"published":1224,"category":870,"image":1225,"draft":772},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1227,"title":1228,"description":1229,"published":1230,"category":768,"image":1231,"draft":772},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1233,"title":1234,"description":1235,"published":1236,"category":870,"image":1237,"draft":772},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1239,"title":1240,"description":1241,"published":1242,"category":768,"image":1243,"draft":772},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1245,"title":1246,"description":1247,"published":1248,"category":768,"image":1249,"draft":772},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":533,"title":1251,"description":1252,"published":1253,"category":768,"image":1254,"draft":772},"New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1256,"title":1257,"description":1258,"published":1259,"category":768,"image":1260,"draft":772},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1262,"title":1263,"description":1264,"published":1265,"category":870,"image":1266,"draft":772},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1268,"title":1269,"description":1270,"published":1271,"category":870,"image":1272,"draft":772},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1274,"title":1275,"description":1276,"published":1277,"category":768,"image":1278,"draft":772},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1280,"title":1281,"description":1282,"published":1283,"category":768,"image":1284,"draft":772},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1286,"title":1287,"description":1288,"published":1289,"category":870,"image":1290,"draft":772},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1292,"title":1293,"description":1294,"published":1295,"category":768,"image":1296,"draft":772},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1298,"title":1299,"description":1300,"published":1295,"category":768,"image":1301,"draft":772},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1303,"title":1304,"description":1305,"published":1306,"category":768,"image":1307,"draft":772},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1309,"title":1310,"description":1311,"published":1312,"category":870,"image":1313,"draft":772},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1315,"title":1316,"description":1317,"published":1318,"category":768,"image":1319,"draft":772},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1321,"title":1322,"description":1323,"published":1318,"category":870,"image":1324,"draft":772},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1326,"title":1327,"description":1328,"published":1329,"category":870,"image":1330,"draft":772},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1332,"title":1333,"description":1334,"published":1329,"category":768,"image":1335,"draft":772},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]