[{"data":1,"prerenderedAt":1182},["ShallowReactive",2],{"blog-en-permission-denied-for-schema-public":3,"blog-index-en":651},{"id":4,"title":5,"body":6,"category":610,"cover":611,"coverAlt":612,"description":613,"draft":614,"extension":615,"faq":616,"image":632,"keywords":633,"meta":640,"navigation":641,"ogTitle":5,"path":642,"published":643,"seo":644,"stem":645,"tldr":646,"updated":643,"__hash__":650},"blog_en\u002Fblog\u002Fpermission-denied-for-schema-public.md","Supabase \"permission denied for schema public\": three causes",{"type":7,"value":8,"toc":596},"minimark",[9,18,21,31,38,46,51,57,87,102,116,125,131,134,138,151,160,163,169,180,184,189,196,202,211,214,218,221,227,237,240,247,250,266,271,274,278,284,296,299,303,313,341,354,358,361,364,370,396,402,422,428,444,448,451,484,491,495,498,507,525,534,551,555,590],[10,11,12,13,17],"p",{},"Your app worked yesterday. Today every screen that reads from Supabase comes up\nempty or shows an error, and the browser console has the same line for each of\nthem: ",[14,15,16],"code",{},"permission denied for schema public",". You open the Supabase dashboard and\nevery table is still there. The SQL Editor reads them without a complaint.",[10,19,20],{},"The response behind that line usually arrives as a 401 or a 403. Trimmed to the\ntwo fields that matter, it says:",[22,23,28],"pre",{"className":24,"code":26,"language":27},[25],"language-text","{\n  \"code\": \"42501\",\n  \"message\": \"permission denied for schema public\"\n}\n","text",[14,29,26],{"__ignoreMap":30},"",[10,32,33,34,37],{},"Supabase \"permission denied for schema public\" comes from Postgres, the database\nSupabase runs on, and its list of causes is short. Every Supabase project is\ncreated with a grant that lets your app into the ",[14,35,36],{},"public"," schema. Somebody, or\nsomething, has taken it away, and putting it back is one line of SQL.",[10,39,40,41,45],{},"Here is the part that is easy to get backwards: ",[42,43,44],"strong",{},"that grant is the front door\nof the building, and the locks on your data are further in."," If somebody\nremoved it to keep strangers out, it kept your app out with them. And whether\nreopening it is safe depends on those inner locks, so they are what to check\nbefore you call this fixed.",[47,48,50],"h2",{"id":49},"what-does-permission-denied-for-schema-public-mean","What does \"permission denied for schema public\" mean?",[10,52,53,54,56],{},"It means the role making the request has no right to enter the ",[14,55,36],{}," schema,\nso Postgres refused before it looked at a single table.",[10,58,59,60,63,64,66,67,70,71,74,75,78,79,82,83,86],{},"A ",[42,61,62],{},"schema"," is a named folder of tables inside your database. ",[14,65,36],{}," is the\none Lovable, Bolt, v0, Cursor, Claude Code and Replit put your tables in unless\ntold otherwise. A ",[42,68,69],{},"role"," is the kind of visitor a request comes from: ",[14,72,73],{},"anon","\nis somebody who is not signed in, ",[14,76,77],{},"authenticated"," is somebody who is, and\n",[14,80,81],{},"service_role"," is your own server code using the secret key. A ",[42,84,85],{},"grant"," gives\none role one permission on one thing.",[10,88,89,90,93,94,101],{},"The permission this error is about is called ",[14,91,92],{},"USAGE",", and\n",[95,96,100],"a",{"href":97,"rel":98},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fddl-priv.html",[99],"nofollow","Postgres's documentation","\ndescribes it as the right to \"look up\" objects within the schema. A role without\nit cannot reach any table in that schema, whatever the table's own settings say.",[10,103,104,105,109,110,112,113,115],{},"If ",[95,106,108],{"href":107},"\u002Fblog\u002Fsupabase-permission-denied-for-table","the table version of this error","\ntaught you to think of each table as a room with a door for each role, the\nschema is the building those rooms stand in, and ",[14,111,92],{}," is its front door.\n",[14,114,16],{}," means your request is standing outside it.\nWhich rooms have their doors open makes no difference, because the request never\ngets as far as a room.",[10,117,118,119,124],{},"Supabase hands that front door to all three roles when a project is created.\n",[95,120,123],{"href":121,"rel":122},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fpostgres\u002Fblob\u002Fdevelop\u002Fmigrations\u002Fdb\u002Finit-scripts\u002F00000000000000-initial-schema.sql",[99],"Supabase's own database image","\nruns this line in its first setup script:",[22,126,129],{"className":127,"code":128,"language":27},[25],"grant usage on schema public to postgres, anon, authenticated, service_role;\n",[14,130,128],{"__ignoreMap":30},[10,132,133],{},"So if your app gets this error, the grant was there once and is gone now.",[47,135,137],{"id":136},"why-does-the-sql-editor-still-work","Why does the SQL Editor still work?",[10,139,140,141,146,147,150],{},"Because the SQL Editor does not use any of your app's roles. Supabase's own\n",[95,142,145],{"href":143,"rel":144},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Ftracking-postgres-role-activity-to-specific-dashboard-users-8d3715",[99],"troubleshooting guide","\nsays a query run from it is \"routed through the ",[14,148,149],{},"postgres"," role at the database\nlevel\".",[10,152,153,155,156,159],{},[14,154,149],{}," is the role that owns your tables, and if the schema itself was\nrebuilt from the dashboard or by your builder, it owns that as well. An owner\nneeds no grant to walk into its own building. So the dashboard lists every\ntable, a ",[14,157,158],{},"select"," in the SQL Editor returns every row, and the same request from\nyour app is turned away at the front door. Nothing on those screens tells you\nthat your app's roles have lost their way in.",[10,161,162],{},"To see what your app sees, ask Postgres about its roles directly. Paste this\ninto the SQL Editor:",[22,164,167],{"className":165,"code":166,"language":27},[25],"select rolname,\n       has_schema_privilege(rolname, 'public', 'USAGE') as can_enter\nfrom pg_roles\nwhere rolname in ('anon', 'authenticated', 'service_role');\n",[14,168,166],{"__ignoreMap":30},[10,170,171,172,175,176,179],{},"Each row should say ",[14,173,174],{},"true",". A row that says ",[14,177,178],{},"false"," is a role your app uses that\ncan no longer get in.",[47,181,183],{"id":182},"the-grant-opens-the-building-and-the-locks-are-inside","The grant opens the building, and the locks are inside",[10,185,186,188],{},[14,187,92],{}," lets a role reach the tables in a schema. It says nothing about which of\nthose tables the role may use, or which rows it gets back.",[10,190,191,192,195],{},"Two more checks stand behind the front door, and both belong to each table. The\ntable's own grant decides whether a role may use that table at all, and a\nmissing one is what ",[14,193,194],{},"permission denied for table"," reports. Then Row Level\nSecurity, the per-row rules you may already have met, decides which rows that\nrole gets back. Postgres asks all three in that order and stops at the first\nrefusal.",[197,198],"diagram",{"alt":199,"caption":200,"src":201},"Three lanes, each a request from anon heading for the same table. In the first, a barred gate marked public is shut and the arrow stops at it with the code 42501, before the table's own door. In the second, the gate is open and the arrow stops at the table's shut door, also 42501. In the third, the gate and the door are both open, the arrow stops at a Row Level Security bar, and two rows of the table light up.","Postgres checks the schema, then the table, then the rows, and stops at the first refusal. A shut gate turns a request away before any table's own door is even tried.","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fthree-checks-in-order-1600x760.png",[10,203,204,205,207,208,210],{},"That order is what makes the schema grant a poor lock. It is all or nothing for\na role: take it from ",[14,206,73],{}," and every screen a signed-out visitor sees stops\nworking at once, including a sign-in page that reads anything from your tables.\nTake it from ",[14,209,77],{}," and the same happens to everybody signed in.\nPostgres's documentation adds that revoking it \"is not a completely secure way\nto prevent object access\", and that a role without it can still read your\ntables' names out of the system catalogs.",[10,212,213],{},"If you are seeing this error at all, your app needs the role that was refused.",[47,215,217],{"id":216},"cause-1-the-schema-was-dropped-and-built-again","Cause 1: the schema was dropped and built again",[10,219,220],{},"This cause takes the most with it. Somebody ran these two lines, or something\nthat does the same thing:",[22,222,225],{"className":223,"code":224,"language":27},[25],"drop schema public cascade;\ncreate schema public;\n",[14,226,224],{"__ignoreMap":30},[10,228,229,230,233,234,236],{},"The first line removes the schema and, because of ",[14,231,232],{},"cascade",", every table, view\nand function inside it. The second makes a new, empty ",[14,235,36],{},". A new schema\nbelongs to the role that made it, and Postgres's documentation is plain that\nnobody else gets any privilege on a schema by default. The grant Supabase ran\nwhen your project was created belonged to the old schema and went with it, and\nSupabase does not run its setup script a second time.",[10,238,239],{},"Those two lines are the shortest way to empty a Postgres database, which makes\nthem a step an AI assistant may take when you ask it to start the database over\nor to make a failing migration run cleanly.",[10,241,242,243,246],{},"Afterwards your tables come back if the app's migrations run again. A\n",[42,244,245],{},"migration"," is one of the files of database changes your builder writes, and\nrunning them all rebuilds the tables they describe. What does not come back is\nanything they never mention, and the front-door grant was made by Supabase\nbefore your first migration existed. A set of migrations your builder wrote may\nnot contain it at all.",[10,248,249],{},"Two more things leave with the old schema:",[251,252,253,260],"ul",{},[254,255,256,259],"li",{},[42,257,258],{},"The automatic grants for new tables."," Postgres keeps these as a schema's\ndefault privileges, and they are deleted along with the schema. Tables made\nafterwards start with no grant for any of your app's roles.",[254,261,262,265],{},[42,263,264],{},"The rows."," Migrations rebuild empty tables. Whatever the old ones held is\nback only if somebody restored a copy that was taken before the reset.",[197,267],{"alt":268,"caption":269,"src":270},"Two walled yards side by side, each marked public. On the left, the original schema: its gate open, three tables inside with their doors open and rows lit, and chips for postgres, anon, authenticated and service_role above it. On the right, the rebuilt schema: the same three tables with their doors shut, the gate shut, the postgres chip still lit, and dashed outlines where the other three were.","Before the reset, all four roles could walk into the schema. After it, the tables can be rebuilt, but the gate and their doors open only for postgres, which built them.","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fdrop-and-create-1600x700.png",[10,272,273],{},"If your tables are back and empty, finding that copy comes before anything else\non this page.",[47,275,277],{"id":276},"cause-2-a-revoke-meant-to-lock-things-down","Cause 2: a revoke meant to lock things down",[10,279,280,281,283],{},"The second way is deliberate. Somebody read that every table in ",[14,282,36],{}," can be\nreached through Supabase's Data API, the web address your app reads and writes\nyour data through, and revoked the schema grant to close it.",[10,285,286,287,292,293,295],{},"The worry behind that is reasonable, and the tool chosen for it is the wrong\none. Supabase's own guide to\n",[95,288,291],{"href":289,"rel":290},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fapi\u002Fsecuring-your-api",[99],"securing the Data API","\nnever touches the schema grant. What it revokes is the automatic access that new\ntables in ",[14,294,36],{}," are given, so each new table stays shut until somebody grants\naccess to it on purpose. Supabase is turning that on for every existing project\non 30 October 2026.",[10,297,298],{},"If a script you ran, or an assistant you asked to harden your database, removed\nthe schema grant, the check query above shows which roles lost it. Put back the\nones your app uses, then do the hardening the way the sections below describe.",[47,300,302],{"id":301},"cause-3-the-error-comes-from-a-migration","Cause 3: the error comes from a migration",[10,304,305,306,309,310,312],{},"When the message appears while something is creating tables, such as a\nmigration, a deploy, or Prisma or Drizzle setting up your database, the missing\npermission is a different one. Creating anything in a schema needs ",[14,307,308],{},"CREATE"," on\nit, and the error text for a missing ",[14,311,308],{}," is the same line.",[10,314,315,316,318,319,321,322,326,327,332,333,336,337,340],{},"Since Postgres 15, ordinary roles no longer get ",[14,317,308],{}," on ",[14,320,36],{}," by default.\n",[95,323,100],{"href":324,"rel":325},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fddl-schemas.html",[99],"\nsays that only databases upgraded from version 14 or earlier still give it to\neveryone. So a separate database user made for a migration tool is refused on\nits very first table. Supabase's own\n",[95,328,331],{"href":329,"rel":330},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fprisma",[99],"Prisma guide"," creates a\n",[14,334,335],{},"prisma"," user, and its setup includes ",[14,338,339],{},"grant create on schema public to prisma",".",[10,342,343,344,347,348,350,351,353],{},"The fix is a ",[14,345,346],{},"create"," grant to that one migration user. Nobody visiting your app\nneeds to make tables, so ",[14,349,73],{}," and ",[14,352,77],{}," never get one.",[47,355,357],{"id":356},"how-to-put-the-grant-back-safely","How to put the grant back safely",[10,359,360],{},"Run one line, confirm all three roles can get in, then reload your app and read\nwhat it says next.",[10,362,363],{},"The line, in the SQL Editor:",[22,365,368],{"className":366,"code":367,"language":27},[25],"grant usage on schema public to anon, authenticated, service_role;\n",[14,369,367],{"__ignoreMap":30},[10,371,372,373,376,377,380,381,384,385,387,388,390,391,395],{},"Keep it to ",[14,374,375],{},"usage",". ",[14,378,379],{},"grant all on schema public"," clears the error too, and on a\nschema ",[14,382,383],{},"all"," means ",[14,386,375],{}," plus ",[14,389,346],{},", the right to add tables of your own.\nSupabase's advice is to grant each role\n",[95,392,394],{"href":289,"rel":393},[99],"the minimum it needs",",\nand your visitors' roles only need to get in.",[10,397,398,399,401],{},"The check query from earlier should now say ",[14,400,174],{}," for all three roles. Reload\nyour app, and one of two things happens:",[251,403,404,410],{},[254,405,406,409],{},[42,407,408],{},"It works."," The front door was the only thing missing.",[254,411,412,415,416,418,419,340],{},[42,413,414],{},"A new message names a table."," ",[14,417,194],{}," means that\ntable's own grant is missing as well, which is what to expect after the first\ncause, because rebuilt tables never got the automatic grants. Give each table\n",[95,420,421],{"href":107},"its grant, Row Level Security and a rule as one change",[10,423,424,425,427],{},"Resist granting every role everything on every table to make the second message\ngo away. A table with a grant to ",[14,426,73],{}," and Row Level Security switched off\nhands every row to anyone who asks, and nothing in your app will look any\ndifferent.",[10,429,430,431,434,435,437,438,443],{},"If the message names another schema, such as ",[14,432,433],{},"permission denied for schema api",", that schema is one somebody made, and it never got the grants ",[14,436,36],{},"\nstarts with. Supabase's guide to\n",[95,439,442],{"href":440,"rel":441},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fapi\u002Fusing-custom-schemas",[99],"using custom schemas","\nlists the lines it needs.",[47,445,447],{"id":446},"what-to-lock-down-instead","What to lock down instead",[10,449,450],{},"The controls that keep strangers away from your data belong to each table, and\nSupabase's securing guide names them:",[452,453,454,463,472,478],"ol",{},[254,455,456,459,460,462],{},[42,457,458],{},"A grant per table, for the roles that need it."," A table of orders needs no\ngrant for ",[14,461,73],{}," at all.",[254,464,465,468,340],{},[42,466,467],{},"Row Level Security on every table, with a rule.",[95,469,471],{"href":470},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","How to switch it on, and check it holds",[254,473,474,477],{},[42,475,476],{},"New tables shut by default."," Revoking the automatic grants does this\ntoday, and 30 October does it for you.",[254,479,480,483],{},[42,481,482],{},"Internal tables kept out of the Data API."," Supabase's guide describes\nputting what your app reads in a dedicated schema, so everything else sits in\nschemas the Data API does not serve.",[10,485,486,487,340],{},"Then look at the result from outside, because none of those screens shows what a\nstranger gets back. Our free scan asks each table your app names how\nmany rows a visitor with no login would get, reads the count without fetching a\nsingle row, and takes about 20 seconds with no account:\n",[95,488,490],{"href":489},"\u002Fsecurity-scanner","scan your app",[47,492,494],{"id":493},"keeping-your-tables-and-what-is-in-them","Keeping your tables, and what is in them",[10,496,497],{},"Two things can still go wrong after today: a later change opens a table to\nstrangers, and a reset like the first cause takes your rows with it.",[10,499,500],{},[42,501,502,506],{},[95,503,505],{"href":504},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking from outside:",[251,508,509,512,519,522],{},[254,510,511],{},"the full security check every hour, on up to three apps",[254,513,514,515,518],{},"a message when a result ",[42,516,517],{},"changes",", so a table that opened after a migration does not wait for you to look",[254,520,521],{},"whether your app is up",[254,523,524],{},"a monthly report, in plain language, of what it saw",[10,526,527],{},[42,528,529,533],{},[95,530,532],{"href":531},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of what is in your tables:",[251,535,536,539,542,545,548],{},[254,537,538],{},"an encrypted copy of your Supabase database on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[254,540,541],{},"each copy verified before it counts, by counting the rows in every table",[254,543,544],{},"your uploaded files as well, once you connect a Storage credential",[254,546,547],{},"a one-click restore, with a safety copy of the current state taken first",[254,549,550],{},"everything Monitor does",[47,552,554],{"id":553},"what-to-do-now","What to do now",[556,557,558],"key-takeaways",{},[251,559,560,566,575,578,581,584],{},[254,561,562,563,565],{},"Run the check query in the SQL Editor. Every role that says ",[14,564,178],{}," is one your app has lost.",[254,567,568,569,572,573,340],{},"Put the grant back with ",[14,570,571],{},"grant usage on schema public to anon, authenticated, service_role;"," and keep it to ",[14,574,375],{},[254,576,577],{},"If the schema was dropped, look at whether your tables are empty, and find a copy taken before the reset.",[254,579,580],{},"If a table error follows, give that table its grant, Row Level Security and a rule together.",[254,582,583],{},"Do your locking down per table, where it can be tuned, and leave the schema grant alone.",[254,585,586,587,589],{},"If the error came from a migration, grant ",[14,588,346],{}," to the migration user and to nobody else.",[10,591,592,593,595],{},"Start with the check query, because one result tells you which of your app's\nroles lost the way in. Then, with the door open again,\n",[95,594,490],{"href":489}," to see what it hands a stranger.",{"title":30,"searchDepth":597,"depth":597,"links":598},3,[599,601,602,603,604,605,606,607,608,609],{"id":49,"depth":600,"text":50},2,{"id":136,"depth":600,"text":137},{"id":182,"depth":600,"text":183},{"id":216,"depth":600,"text":217},{"id":276,"depth":600,"text":277},{"id":301,"depth":600,"text":302},{"id":356,"depth":600,"text":357},{"id":446,"depth":600,"text":447},{"id":493,"depth":600,"text":494},{"id":553,"depth":600,"text":554},"Security basics","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcover-1200x630.png","A walled yard of database tables, every door inside open and lit, behind a front gate that stands shut with its bars down.","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.",false,"md",[617,620,623,626,629],{"q":618,"a":619},"What does \"permission denied for schema public\" mean in Supabase?","It means the role making the request, usually anon or authenticated, has no right to enter the public schema, so Postgres refused before it looked at any table. It carries the code 42501 and usually reaches your app as a 401 or a 403. Every Supabase project starts with that right granted, so the error means somebody or something removed it.",{"q":621,"a":622},"Is it safe to grant usage on schema public?","Yes. Every Supabase project starts with exactly that grant. It only lets a role reach the tables in the schema: each table still needs its own grant, and Row Level Security still decides which rows each visitor gets. What deserves a look is the tables behind it, because one with a grant to anon and Row Level Security switched off hands every row to anyone who asks.",{"q":624,"a":625},"How is this different from \"permission denied for table\"?","The schema error stops a request before it reaches any table, so every table in the schema fails at once. The table error is about one table that has no grant for that role, and the rest of your app keeps working. Both carry the code 42501, so read the words in the message to tell them apart.",{"q":627,"a":628},"Why do my tables work in the Supabase SQL Editor but not in my app?","Because the SQL Editor runs your queries as the postgres role, which owns your tables and does not need the grant your app has lost. Your app uses anon for signed-out visitors and authenticated for signed-in ones. Ask Postgres about those two roles directly, with has_schema_privilege, to see what your app sees.",{"q":630,"a":631},"What should I lock down instead of the schema grant?","The tables. Give each table a grant only for the roles that need it, switch on Row Level Security with a rule on every table, and let new tables start with no access at all. Supabase makes that last part the default for existing projects on 30 October 2026.","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",[16,634,635,636,637,638,639],"supabase permission denied for schema public","supabase permission denied for schema","grant usage on schema public","postgres 42501 schema public","drop schema public cascade supabase","supabase anon role permissions",{},true,"\u002Fblog\u002Fpermission-denied-for-schema-public","2026-10-18",{"title":5,"description":613},"blog\u002Fpermission-denied-for-schema-public",[647,648,649],"Supabase \"permission denied for schema public\" means the role making the request has no right to enter the public schema at all, so Postgres refused before it looked at a single table.","Every Supabase project starts with that right granted to anon, authenticated and service_role. If your app gets this error, something removed it: the schema was dropped and built again, or a script revoked the grant.","Putting it back is one line of SQL. The grant only lets a role reach your tables, and Row Level Security still decides which rows each visitor gets, so check those rules before you call it fixed.","Dv7UKCDlIpeCYCfdWrhXYU5iTC27uYqUuZEvm8wS03g",[652,658,664,670,676,682,688,694,700,706,712,719,725,731,737,743,749,755,761,767,773,779,785,786,792,798,804,810,816,822,828,834,840,846,852,858,864,870,876,882,888,894,900,906,912,918,922,928,934,940,946,952,958,964,970,976,982,988,994,1000,1006,1012,1017,1023,1029,1035,1041,1047,1053,1059,1065,1071,1077,1083,1089,1095,1101,1107,1113,1119,1125,1131,1137,1143,1148,1154,1160,1166,1171,1177],{"path":653,"title":654,"description":655,"published":656,"category":610,"image":657,"draft":614},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":659,"title":660,"description":661,"published":662,"category":610,"image":663,"draft":614},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":665,"title":666,"description":667,"published":668,"category":610,"image":669,"draft":614},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":671,"title":672,"description":673,"published":674,"category":610,"image":675,"draft":614},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":677,"title":678,"description":679,"published":680,"category":610,"image":681,"draft":614},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":683,"title":684,"description":685,"published":686,"category":610,"image":687,"draft":614},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":689,"title":690,"description":691,"published":692,"category":610,"image":693,"draft":614},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":695,"title":696,"description":697,"published":698,"category":610,"image":699,"draft":614},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":701,"title":702,"description":703,"published":704,"category":610,"image":705,"draft":614},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":707,"title":708,"description":709,"published":710,"category":610,"image":711,"draft":614},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":713,"title":714,"description":715,"published":716,"category":717,"image":718,"draft":614},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":720,"title":721,"description":722,"published":723,"category":610,"image":724,"draft":614},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":726,"title":727,"description":728,"published":729,"category":610,"image":730,"draft":614},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":732,"title":733,"description":734,"published":735,"category":610,"image":736,"draft":614},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":738,"title":739,"description":740,"published":741,"category":610,"image":742,"draft":614},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":744,"title":745,"description":746,"published":747,"category":610,"image":748,"draft":614},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":750,"title":751,"description":752,"published":753,"category":610,"image":754,"draft":614},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":756,"title":757,"description":758,"published":759,"category":610,"image":760,"draft":614},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":762,"title":763,"description":764,"published":765,"category":610,"image":766,"draft":614},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":768,"title":769,"description":770,"published":771,"category":610,"image":772,"draft":614},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":774,"title":775,"description":776,"published":777,"category":610,"image":778,"draft":614},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":780,"title":781,"description":782,"published":783,"category":610,"image":784,"draft":614},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":642,"title":5,"description":613,"published":643,"category":610,"image":632,"draft":614},{"path":787,"title":788,"description":789,"published":790,"category":610,"image":791,"draft":614},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":793,"title":794,"description":795,"published":796,"category":610,"image":797,"draft":614},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":799,"title":800,"description":801,"published":802,"category":610,"image":803,"draft":614},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":805,"title":806,"description":807,"published":808,"category":610,"image":809,"draft":614},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":811,"title":812,"description":813,"published":814,"category":610,"image":815,"draft":614},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":817,"title":818,"description":819,"published":820,"category":610,"image":821,"draft":614},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":823,"title":824,"description":825,"published":826,"category":610,"image":827,"draft":614},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":829,"title":830,"description":831,"published":832,"category":610,"image":833,"draft":614},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":835,"title":836,"description":837,"published":838,"category":610,"image":839,"draft":614},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":841,"title":842,"description":843,"published":844,"category":610,"image":845,"draft":614},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":847,"title":848,"description":849,"published":850,"category":610,"image":851,"draft":614},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":853,"title":854,"description":855,"published":856,"category":610,"image":857,"draft":614},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":859,"title":860,"description":861,"published":862,"category":610,"image":863,"draft":614},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":865,"title":866,"description":867,"published":868,"category":610,"image":869,"draft":614},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":871,"title":872,"description":873,"published":874,"category":610,"image":875,"draft":614},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":877,"title":878,"description":879,"published":880,"category":610,"image":881,"draft":614},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":883,"title":884,"description":885,"published":886,"category":610,"image":887,"draft":614},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":889,"title":890,"description":891,"published":892,"category":610,"image":893,"draft":614},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":895,"title":896,"description":897,"published":898,"category":610,"image":899,"draft":614},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":901,"title":902,"description":903,"published":904,"category":717,"image":905,"draft":614},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":907,"title":908,"description":909,"published":910,"category":717,"image":911,"draft":614},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":913,"title":914,"description":915,"published":916,"category":717,"image":917,"draft":614},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":107,"title":919,"description":920,"published":916,"category":610,"image":921,"draft":614},"Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":923,"title":924,"description":925,"published":926,"category":610,"image":927,"draft":614},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":929,"title":930,"description":931,"published":932,"category":610,"image":933,"draft":614},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":935,"title":936,"description":937,"published":938,"category":717,"image":939,"draft":614},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":941,"title":942,"description":943,"published":944,"category":610,"image":945,"draft":614},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":947,"title":948,"description":949,"published":950,"category":610,"image":951,"draft":614},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":953,"title":954,"description":955,"published":956,"category":610,"image":957,"draft":614},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":959,"title":960,"description":961,"published":962,"category":610,"image":963,"draft":614},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":965,"title":966,"description":967,"published":968,"category":610,"image":969,"draft":614},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":971,"title":972,"description":973,"published":974,"category":610,"image":975,"draft":614},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":977,"title":978,"description":979,"published":980,"category":610,"image":981,"draft":614},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":983,"title":984,"description":985,"published":986,"category":610,"image":987,"draft":614},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":989,"title":990,"description":991,"published":992,"category":717,"image":993,"draft":614},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":995,"title":996,"description":997,"published":998,"category":717,"image":999,"draft":614},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1001,"title":1002,"description":1003,"published":1004,"category":717,"image":1005,"draft":614},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1007,"title":1008,"description":1009,"published":1010,"category":610,"image":1011,"draft":614},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":470,"title":1013,"description":1014,"published":1015,"category":610,"image":1016,"draft":614},"Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1018,"title":1019,"description":1020,"published":1021,"category":610,"image":1022,"draft":614},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1024,"title":1025,"description":1026,"published":1027,"category":610,"image":1028,"draft":614},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1030,"title":1031,"description":1032,"published":1033,"category":610,"image":1034,"draft":614},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1036,"title":1037,"description":1038,"published":1039,"category":610,"image":1040,"draft":614},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1042,"title":1043,"description":1044,"published":1045,"category":610,"image":1046,"draft":614},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1048,"title":1049,"description":1050,"published":1051,"category":610,"image":1052,"draft":614},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1054,"title":1055,"description":1056,"published":1057,"category":610,"image":1058,"draft":614},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1060,"title":1061,"description":1062,"published":1063,"category":610,"image":1064,"draft":614},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1066,"title":1067,"description":1068,"published":1069,"category":717,"image":1070,"draft":614},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1072,"title":1073,"description":1074,"published":1075,"category":610,"image":1076,"draft":614},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1078,"title":1079,"description":1080,"published":1081,"category":717,"image":1082,"draft":614},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1084,"title":1085,"description":1086,"published":1087,"category":610,"image":1088,"draft":614},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1090,"title":1091,"description":1092,"published":1093,"category":610,"image":1094,"draft":614},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1096,"title":1097,"description":1098,"published":1099,"category":610,"image":1100,"draft":614},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1102,"title":1103,"description":1104,"published":1105,"category":610,"image":1106,"draft":614},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1108,"title":1109,"description":1110,"published":1111,"category":717,"image":1112,"draft":614},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1114,"title":1115,"description":1116,"published":1117,"category":717,"image":1118,"draft":614},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1120,"title":1121,"description":1122,"published":1123,"category":610,"image":1124,"draft":614},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1126,"title":1127,"description":1128,"published":1129,"category":610,"image":1130,"draft":614},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1132,"title":1133,"description":1134,"published":1135,"category":717,"image":1136,"draft":614},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1138,"title":1139,"description":1140,"published":1141,"category":610,"image":1142,"draft":614},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1144,"title":1145,"description":1146,"published":1141,"category":610,"image":1147,"draft":614},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1149,"title":1150,"description":1151,"published":1152,"category":610,"image":1153,"draft":614},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1155,"title":1156,"description":1157,"published":1158,"category":717,"image":1159,"draft":614},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1161,"title":1162,"description":1163,"published":1164,"category":610,"image":1165,"draft":614},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1167,"title":1168,"description":1169,"published":1164,"category":717,"image":1170,"draft":614},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1172,"title":1173,"description":1174,"published":1175,"category":717,"image":1176,"draft":614},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1178,"title":1179,"description":1180,"published":1175,"category":610,"image":1181,"draft":614},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]