[{"data":1,"prerenderedAt":1192},["ShallowReactive",2],{"blog-en-supabase-auth-redirects-to-localhost":3,"blog-index-en":662},{"id":4,"title":5,"body":6,"category":619,"cover":620,"coverAlt":621,"description":622,"draft":623,"extension":624,"faq":625,"image":641,"keywords":642,"meta":650,"navigation":651,"ogTitle":652,"path":653,"published":654,"seo":655,"stem":656,"tldr":657,"updated":654,"__hash__":661},"blog_en\u002Fblog\u002Fsupabase-auth-redirects-to-localhost.md","Why Supabase email links redirect to localhost:3000",{"type":7,"value":8,"toc":607},"minimark",[9,13,24,31,38,46,51,54,73,79,95,99,102,133,155,164,170,178,182,185,216,220,223,237,240,244,255,280,298,319,339,407,413,417,420,427,440,443,446,482,487,490,497,501,504,513,527,536,556,560,595],[10,11,12],"p",{},"A new user signs up on your live app, opens the confirmation email and presses\nthe button. Their browser opens a page that says \"This site can't be reached\"\nand \"localhost refused to connect\", over an address that starts like this:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","http:\u002F\u002Flocalhost:3000\u002F#access_token=…&expires_at=…&expires_in=…&refresh_token=…&sb=&token_type=bearer&type=signup\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26,27,30],{},"If your app uses the PKCE flow, it ends in ",[21,28,29],{},"?code=…"," instead. You built the app with Lovable, Bolt, v0, Cursor, Claude Code or Replit, it ran\nperfectly in preview, and signing in with a password still works.",[10,32,33,34,37],{},"A Supabase redirect to localhost means Supabase Auth, the part of Supabase that\nsigns people in, finished its job and then sent the person to your project's\nSite URL, which still says ",[21,35,36],{},"http:\u002F\u002Flocalhost:3000",". That address means \"this\ncomputer\". On your user's computer nothing is there. The fix is two settings on\none page of your Supabase dashboard.",[10,39,40,41,45],{},"Here is the part the quick fixes online get wrong: ",[42,43,44],"strong",{},"the wildcard that makes\nthis message go away in one line is also the one that lets a stranger's link\nsend your users to their page, already signed in."," The settings below make the\nlinks work and keep that door shut.",[47,48,50],"h2",{"id":49},"what-does-a-supabase-redirect-to-localhost-mean","What does a Supabase redirect to localhost mean?",[10,52,53],{},"It means Supabase sent the person to the default address on your project,\nbecause it did not accept a better one.",[10,55,56,57,64,65,68,69,72],{},"Every email Supabase sends for you, whether a sign-up confirmation, a magic\nlink, a password reset or an invitation, links first to your project's own\naddress. Supabase's\n",[58,59,63],"a",{"href":60,"rel":61},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fauth-email-templates",[62],"nofollow","email template guide","\ngives the shape: ",[21,66,67],{},"https:\u002F\u002Fproject-ref.supabase.co\u002Fauth\u002Fv1\u002Fverify?token=…&type=email&redirect_to=https:\u002F\u002Fexample.com\u002Fpath",".\nSupabase checks the token there and then sends the browser on to whatever\n",[21,70,71],{},"redirect_to"," names.",[10,74,75,76,78],{},"Think of it as a signpost at Supabase's door. Each person who opens a link is\nsigned in at the door and then sent on, key in hand, along one of the arms. You\nput the arms up. The Site URL is the arm everyone takes when no other arm\nfits, and on a new project it points at ",[21,77,36],{},": the workshop\nwhere the app was built, which on anybody else's machine is an empty room.",[10,80,81,82,87,88,91,92,94],{},"Supabase's\n",[58,83,86],{"href":84,"rel":85},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fredirect-urls",[62],"redirect guide"," says the\nSite URL \"defines the default redirect URL when no ",[21,89,90],{},"redirectTo"," is specified in\nthe code\", tells you to \"Change this from ",[21,93,36],{}," to your\nproduction URL\", and calls the setting \"critical for email confirmations and\npassword resets.\"",[47,96,98],{"id":97},"why-does-supabase-ignore-the-address-my-app-asked-for","Why does Supabase ignore the address my app asked for?",[10,100,101],{},"Because that address is not on your Redirect URLs list, and Supabase falls back\nwithout telling you.",[10,103,104,105,108,109,112,113,116,117,119,120,112,123,126,127,132],{},"Your app can name where people should land. In Supabase's JavaScript library\nthat is ",[21,106,107],{},"emailRedirectTo"," on ",[21,110,111],{},"signUp"," and ",[21,114,115],{},"signInWithOtp",", and ",[21,118,90],{}," on\n",[21,121,122],{},"resetPasswordForEmail",[21,124,125],{},"signInWithOAuth",". Supabase Auth then decides in\n",[58,128,131],{"href":129,"rel":130},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Futilities\u002Frequest.go",[62],"a short function",",\nin this order:",[134,135,136,143,149],"ol",{},[137,138,139,142],"li",{},[42,140,141],{},"The address your app asked for",", if it matches an entry on your Redirect\nURLs list or sits on the same domain as your Site URL.",[137,144,145,148],{},[42,146,147],{},"The address of the page the request came from",", as the browser reported\nit, under the same rule.",[137,150,151,154],{},[42,152,153],{},"Otherwise the Site URL."," Supabase raises no error, and your app's\nconsole shows nothing.",[10,156,157,158,163],{},"It makes that decision when the email is sent, and the address it chose goes\ninto the link. When somebody opens the link, Supabase checks that address again\nagainst your settings as they are at that moment. Supabase's own\n",[58,159,162],{"href":160,"rel":161},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fwhy-am-i-being-redirected-to-the-wrong-url-when-using-auth-redirectto-option-_vqIeO",[62],"troubleshooting answer","\nputs the rule in one line: \"In order for the provided redirectTo option to work\nyou must set the exact URL in the shown Redirect URL's setting.\"",[165,166],"diagram",{"alt":167,"caption":168,"src":169},"An email link reaches a signpost with three arms. The first two, for the address the app asked for and the page the request came from, are each checked against a list and crossed out. The third arm, the Site URL, takes the person to a laptop with a dark screen and a red cross.","Supabase tries the address your app asked for, then the page the request came from. When neither is on your list, the Site URL decides.","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fthree-tries-1600x760.png",[10,171,172,173,177],{},"The same setting decides where \"Sign in with Google\" sends people back to, so\na Google button that lands on localhost has the same cause. A Google button that\nstops earlier, on a page reading \"Unsupported provider: provider is not\nenabled\", is\n",[58,174,176],{"href":175},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","a switch in Supabase and a list in Google","\ninstead.",[47,179,181],{"id":180},"why-you-did-not-see-it-before-launch","Why you did not see it before launch",[10,183,184],{},"Because the two ways you tested never reach the Site URL.",[186,187,188,194,200],"ul",{},[137,189,190,193],{},[42,191,192],{},"Password sign-in signs people in inside the page."," No email link and no\ntrip through Supabase's door, so the signpost is never read.",[137,195,196,199],{},[42,197,198],{},"If you build with Cursor or Claude Code and your development server was\nrunning on port 3000"," when you tested the email, the link opened your own\nlocal copy and looked like it worked.",[137,201,202,205,206,211,212,215],{},[42,203,204],{},"On Lovable's built-in backend you may never meet it."," Lovable's\n",[58,207,210],{"href":208,"rel":209},"https:\u002F\u002Fdocs.lovable.dev\u002Ffeatures\u002Fauthentication",[62],"authentication docs"," say\nit sets the Site URL to your published ",[21,213,214],{},"lovable.app"," address when you publish,\nand adds a custom domain to the redirect URLs when you connect one. The same\npage says apps that use your own Supabase project \"get no automatic updates\".",[47,217,219],{"id":218},"is-the-account-confirmed-even-though-the-page-did-not-load","Is the account confirmed even though the page did not load?",[10,221,222],{},"Yes, for a sign-up confirmation. Supabase confirms first and sends the browser\non afterwards.",[10,224,225,226,231,232,236],{},"In\n",[58,227,230],{"href":228,"rel":229},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Fapi\u002Fverify.go",[62],"the code that handles the link",",\nthe account is confirmed before the redirect is sent.\nThe page that fails to load comes after the work is done. So tell the person\nthey can sign in on your live site with the password they chose. Pressing the\nsame email again will not help: the link works once, and the second press\nanswers\n",[58,233,235],{"href":234},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","\"Email link is invalid or has expired\"",".",[10,238,239],{},"A magic link or a password reset is different. That sign-in went to localhost\nand stayed there, so once you have fixed the settings, the person needs a new\nemail.",[47,241,243],{"id":242},"how-to-fix-the-supabase-redirect-to-localhost","How to fix the Supabase redirect to localhost",[10,245,246,247,250,251,254],{},"Change the Site URL, then list the other addresses you send people to. Both are\non the ",[42,248,249],{},"URL Configuration"," page under ",[42,252,253],{},"Authentication"," in your Supabase\ndashboard.",[10,256,257,264,267,268,270,271,275,276,279],{},[42,258,259,260,263],{},"Set the Site URL to your live address, with ",[21,261,262],{},"https:\u002F\u002F"," in front.",[21,265,266],{},"https:\u002F\u002Fyourapp.com",", written in full. Left without the ",[21,269,262],{},", Supabase\nreads it as a path on its own address, and the person lands on your Supabase\nproject with\n",[58,272,274],{"href":273},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\""," instead.\nAny address on that domain is then accepted at any path without a list entry,\nso ",[21,277,278],{},"https:\u002F\u002Fyourapp.com\u002Fwelcome"," works as soon as the Site URL is right.",[10,281,282,285,286,289,290,293,294,297],{},[42,283,284],{},"Add the other addresses to Redirect URLs."," The ",[21,287,288],{},"www"," version if people use\nit, the builder's published address (",[21,291,292],{},"https:\u002F\u002Fyourapp.lovable.app",", for\nexample) if people sign up there, and nothing else. An entry is a pattern, so\n",[21,295,296],{},"https:\u002F\u002Fyourapp.com\u002F**"," covers every page on that one domain.",[10,299,300,303,304,307,308,310,311,314,315,318],{},[42,301,302],{},"Check what your code asks for."," If it passes ",[21,305,306],{},"window.location.origin",", the\naddress is whatever the page was opened on, and every address that can produce\nhas to be on your Site URL's domain or on the list. Compare them letter for\nletter: ",[21,309,288],{}," or not, ",[21,312,313],{},"https"," or not. An entry without ",[21,316,317],{},"\u002F**"," at the end matches\nthat exact address and nothing under it.",[10,320,321,324,325,328,329,331,332,334,335,338],{},[42,322,323],{},"Check your email templates."," A template that builds its own link from\n",[21,326,327],{},"{{ .SiteURL }}"," sends everyone to the Site URL whatever your app asked for.\nSupabase's redirect guide says that \"When using a ",[21,330,90],{}," option, you may\nneed to replace the ",[21,333,327],{}," with ",[21,336,337],{},"{{ .RedirectTo }}"," in your email\ntemplates.\"",[340,341,342,355],"table",{},[343,344,345],"thead",{},[346,347,348,352],"tr",{},[349,350,351],"th",{},"What you see",[349,353,354],{},"What to change",[356,357,358,370,378,386,397],"tbody",{},[346,359,360,367],{},[361,362,363,364],"td",{},"Every link opens ",[21,365,366],{},"localhost:3000",[361,368,369],{},"The Site URL",[346,371,372,375],{},[361,373,374],{},"Links open your Site URL instead of the address your code asked for",[361,376,377],{},"Add that address to Redirect URLs, letter for letter",[346,379,380,383],{},[361,381,382],{},"The live domain works and the builder's published address does not",[361,384,385],{},"Add the published address to Redirect URLs",[346,387,388,391],{},[361,389,390],{},"A link opens your Supabase address with \"No API key found in request\"",[361,392,393,394,396],{},"Add ",[21,395,262],{}," to the Site URL",[346,398,399,402],{},[361,400,401],{},"The address your app asks for is listed and the link still ignores it",[361,403,404,405],{},"The email template's ",[21,406,327],{},[10,408,409,410,412],{},"Then sign up again with an address you have not used. An email sent before the\nfix with Supabase's standard link in it, opened within its hour, now lands on\nyour live site, because Supabase\nchecks the address again when the link is opened. That holds unless\n",[21,411,36],{}," is still on your list.",[47,414,416],{"id":415},"which-redirect-urls-are-safe-to-allow","Which redirect URLs are safe to allow?",[10,418,419],{},"The exact addresses you own. A wildcard belongs to preview deployments, and only\nscoped to your own team or project.",[10,421,422,423,426],{},"Supabase's redirect guide puts it plainly: \"While the 'globstar' (",[21,424,425],{},"**",") is\nuseful for local development and preview URLs, we recommend setting the exact\nredirect URL path for your site URL in production.\"",[10,428,429,430,435,436,439],{},"The reason is what travels with the person. In the default flow, Supabase writes\nthe new session into the address it sends them to:\n",[58,431,434],{"href":432,"rel":433},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Ftokens\u002Fservice.go",[62],"the code that builds it","\nappends ",[21,437,438],{},"#access_token=…&refresh_token=…"," to the redirect address. Whatever\npage sits at that address can read those two values, and with them it is that\nuser. On the signpost, the arm decides who receives the key.",[10,441,442],{},"So an entry that matches an address somebody else controls is a way into your\nusers' accounts. Anybody can ask your project to email one of your users a\nsign-in link, using the public key that is in your app by design, and name\ntheir own page as the place to land. The email that arrives really is from your\napp. The PKCE flow does not change this, because the person who wrote that\nlink started the sign-in, and PKCE hands the session to whoever started it.",[10,444,445],{},"The patterns that match addresses other people can create:",[186,447,448,456,467],{},[137,449,450,455],{},[42,451,452,454],{},[21,453,425],{}," on its own"," matches every address there is.",[137,457,458,463,464,236],{},[42,459,460],{},[21,461,462],{},"https:\u002F\u002F*.vercel.app\u002F**"," matches every Vercel deployment on the\ninternet, and anyone can deploy one. Supabase's own example carries your team:\n",[21,465,466],{},"https:\u002F\u002F*-\u003Cteam-or-account-slug>.vercel.app\u002F**",[137,468,469,478,479,236],{},[42,470,471,474,475],{},[21,472,473],{},"https:\u002F\u002F*.lovable.app\u002F**",", ",[21,476,477],{},"https:\u002F\u002F*.netlify.app\u002F**"," and the same shape\non any builder's domain do the same thing for that builder. Supabase's Netlify\nexample is scoped too: ",[21,480,481],{},"https:\u002F\u002F**--my_org.netlify.app\u002F**",[165,483],{"alt":484,"caption":485,"src":486},"Two signposts. On the left the list holds one exact address, a crafted link pointing elsewhere is refused, and the person arrives at their own house with the key. On the right the list holds a wildcard, the crafted link is accepted, and the key goes to a different house outlined in red.","An exact entry sends a crafted link home. A wildcard that matches other people's apps lets it deliver the sign-in to them.","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fwho-gets-the-key-1600x760.png",[10,488,489],{},"If you have just fixed this by pasting a wildcard, look at the list again\ntoday.",[10,491,492,493,236],{},"Going live is also when the other settings that only matter in production get\nlooked at. Our free scan reads your live app from outside and reports what a\nstranger can reach: tables that answer anyone, secret keys in the code your app\nsends, missing headers, the certificate. It takes about 20 seconds and needs no\naccount: ",[58,494,496],{"href":495},"\u002Fsecurity-scanner","scan your app",[47,498,500],{"id":499},"keeping-an-eye-on-the-live-app-after-launch","Keeping an eye on the live app after launch",[10,502,503],{},"This setting gets fixed once. What your app sends to visitors changes with\nevery deploy, and that part can be watched from outside.",[10,505,506],{},[42,507,508,512],{},[58,509,511],{"href":510},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking your live app:",[186,514,515,518,521,524],{},[137,516,517],{},"whether it is up, every 60 seconds, so \"the link does not work\" can be told apart from \"the site is down\"",[137,519,520],{},"all nine checks every hour, on up to three apps, including secret keys in the code your app sends to visitors",[137,522,523],{},"a message when a result changes, so a problem that ships in a later deploy reaches you without you going to look",[137,525,526],{},"a monthly report, in plain language, of what it saw",[10,528,529],{},[42,530,531,535],{},[58,532,534],{"href":533},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database,\naccounts included:",[186,537,538,541,544,547,550,553],{},[137,539,540],{},"an encrypted copy on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[137,542,543],{},"the auth schema your users' accounts live in, so they come back with everything else",[137,545,546],{},"each copy verified before it counts, by counting the rows in every table",[137,548,549],{},"your uploaded files as well, once you connect a Storage credential",[137,551,552],{},"a one-click restore, with a safety copy of the current state taken first",[137,554,555],{},"everything Monitor does",[47,557,559],{"id":558},"what-to-do-now","What to do now",[561,562,563],"key-takeaways",{},[186,564,565,571,577,589,592],{},[137,566,567,568,570],{},"Set the Site URL on the URL Configuration page to your live address, ",[21,569,262],{}," included.",[137,572,573,574,576],{},"Add the other exact addresses you send people to, such as the ",[21,575,288],{}," version and the builder's published address, to Redirect URLs.",[137,578,579,580,582,583,585,586,588],{},"Make sure every address your code passes as ",[21,581,107],{}," or ",[21,584,90],{}," is on the list, and use ",[21,587,337],{}," in templates that should follow it.",[137,590,591],{},"Tell anyone who met the localhost page after signing up that their account is confirmed. Magic links and password resets need a new email.",[137,593,594],{},"Keep wildcards to previews scoped to your team, and never allow every app on a builder's domain.",[10,596,597,598,601,602,606],{},"If people press the new link and are told it has expired,\n",[58,599,600],{"href":234},"that message has a page of its own",".\nThe ",[58,603,605],{"href":604},"\u002Fchecklist","10-minute security checklist"," covers what else tends to be\nleft open in a newly launched app.",{"title":23,"searchDepth":608,"depth":608,"links":609},3,[610,612,613,614,615,616,617,618],{"id":49,"depth":611,"text":50},2,{"id":97,"depth":611,"text":98},{"id":180,"depth":611,"text":181},{"id":218,"depth":611,"text":219},{"id":242,"depth":611,"text":243},{"id":415,"depth":611,"text":416},{"id":499,"depth":611,"text":500},{"id":558,"depth":611,"text":559},"Security basics","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcover-1200x630.png","A signpost whose lit arm points away from the house it should lead to and towards a laptop with a dark screen.","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.",false,"md",[626,629,632,635,638],{"q":627,"a":628},"Why does my Supabase confirmation email open localhost:3000?","Because Supabase sent the person to your project's Site URL, and the Site URL still says http:\u002F\u002Flocalhost:3000. Supabase uses it whenever the address your app asked for is missing from the Redirect URLs list, or your app asked for none. Change it on the URL Configuration page under Authentication.",{"q":630,"a":631},"Is the account confirmed if the link opened localhost?","Yes, for a sign-up confirmation. Supabase confirms the address first and sends the browser on afterwards, so the failed page comes after the work is done. The person can sign in on your live site with the password they chose. A magic link or a password reset has to be sent again.",{"q":633,"a":634},"I added my site to Redirect URLs and it still goes to localhost. Why?","The entry has to match the address Supabase is offered, letter for letter: www or not, https or not, and the path, because an entry without \u002F** at the end matches that one address only. If they match and the link still ignores it, your email template builds its link from {{ .SiteURL }}. And fix the Site URL itself, since it is where everything else falls back to.",{"q":636,"a":637},"Do I need to add my Site URL to the Redirect URLs list?","No. Supabase accepts any address on the Site URL's own domain without a list entry, at any path. The list is for the other addresses: a www version, the builder's published address, preview deployments.",{"q":639,"a":640},"Can I use a wildcard in Supabase Redirect URLs?","For previews, scoped to your own team or project, as in Supabase's own examples. Never one that matches addresses other people can create, such as every app on vercel.app or lovable.app. Supabase recommends the exact address for your site in production.","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",[643,644,645,646,647,648,649],"supabase redirect to localhost","supabase magic link localhost 3000","supabase site url","supabase redirect urls","supabase email confirmation wrong url","supabase redirect url wildcard","localhost refused to connect supabase",{},true,"Supabase email links redirect to localhost:3000","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","2026-11-02",{"title":5,"description":622},"blog\u002Fsupabase-auth-redirects-to-localhost",[658,659,660],"A Supabase redirect to localhost:3000 comes from the Site URL on the URL Configuration page. A project starts with it set to http:\u002F\u002Flocalhost:3000, and every email link falls back to it when the address your app asked for is not on the Redirect URLs list.","The person who pressed a sign-up link is usually confirmed already. Supabase confirms the account before it sends them on, so they can sign in on your real site.","Set the Site URL to your live address and list the exact addresses you use. A wildcard broad enough to match somebody else's app lets a crafted link send your users there, signed in.","Y5EJlWTJMkmcZ-A5n_PJcJQtqBJG-cg02wjIwiUQge0",[663,669,674,680,686,692,698,704,705,710,716,723,729,735,741,747,753,759,765,771,777,783,789,795,801,807,813,819,825,831,837,843,849,855,860,866,872,878,884,890,896,902,908,914,920,926,931,937,943,949,955,961,967,973,979,985,991,997,1003,1009,1015,1021,1027,1033,1039,1045,1051,1057,1063,1069,1075,1081,1087,1093,1099,1105,1111,1117,1123,1129,1135,1141,1147,1153,1158,1164,1170,1176,1181,1187],{"path":664,"title":665,"description":666,"published":667,"category":619,"image":668,"draft":623},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":175,"title":670,"description":671,"published":672,"category":619,"image":673,"draft":623},"\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":675,"title":676,"description":677,"published":678,"category":619,"image":679,"draft":623},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":681,"title":682,"description":683,"published":684,"category":619,"image":685,"draft":623},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":687,"title":688,"description":689,"published":690,"category":619,"image":691,"draft":623},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":693,"title":694,"description":695,"published":696,"category":619,"image":697,"draft":623},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":699,"title":700,"description":701,"published":702,"category":619,"image":703,"draft":623},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":653,"title":5,"description":622,"published":654,"category":619,"image":641,"draft":623},{"path":234,"title":706,"description":707,"published":708,"category":619,"image":709,"draft":623},"Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":711,"title":712,"description":713,"published":714,"category":619,"image":715,"draft":623},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":717,"title":718,"description":719,"published":720,"category":721,"image":722,"draft":623},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":724,"title":725,"description":726,"published":727,"category":619,"image":728,"draft":623},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":730,"title":731,"description":732,"published":733,"category":619,"image":734,"draft":623},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":736,"title":737,"description":738,"published":739,"category":619,"image":740,"draft":623},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":742,"title":743,"description":744,"published":745,"category":619,"image":746,"draft":623},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":748,"title":749,"description":750,"published":751,"category":619,"image":752,"draft":623},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":754,"title":755,"description":756,"published":757,"category":619,"image":758,"draft":623},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":760,"title":761,"description":762,"published":763,"category":619,"image":764,"draft":623},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":766,"title":767,"description":768,"published":769,"category":619,"image":770,"draft":623},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":772,"title":773,"description":774,"published":775,"category":619,"image":776,"draft":623},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":778,"title":779,"description":780,"published":781,"category":619,"image":782,"draft":623},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":784,"title":785,"description":786,"published":787,"category":619,"image":788,"draft":623},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":790,"title":791,"description":792,"published":793,"category":619,"image":794,"draft":623},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":796,"title":797,"description":798,"published":799,"category":619,"image":800,"draft":623},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":802,"title":803,"description":804,"published":805,"category":619,"image":806,"draft":623},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":808,"title":809,"description":810,"published":811,"category":619,"image":812,"draft":623},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":814,"title":815,"description":816,"published":817,"category":619,"image":818,"draft":623},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":820,"title":821,"description":822,"published":823,"category":619,"image":824,"draft":623},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":826,"title":827,"description":828,"published":829,"category":619,"image":830,"draft":623},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":832,"title":833,"description":834,"published":835,"category":619,"image":836,"draft":623},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":838,"title":839,"description":840,"published":841,"category":619,"image":842,"draft":623},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":844,"title":845,"description":846,"published":847,"category":619,"image":848,"draft":623},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":850,"title":851,"description":852,"published":853,"category":619,"image":854,"draft":623},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":273,"title":856,"description":857,"published":858,"category":619,"image":859,"draft":623},"\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":861,"title":862,"description":863,"published":864,"category":619,"image":865,"draft":623},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":867,"title":868,"description":869,"published":870,"category":619,"image":871,"draft":623},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":873,"title":874,"description":875,"published":876,"category":619,"image":877,"draft":623},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":879,"title":880,"description":881,"published":882,"category":619,"image":883,"draft":623},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":885,"title":886,"description":887,"published":888,"category":619,"image":889,"draft":623},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":891,"title":892,"description":893,"published":894,"category":619,"image":895,"draft":623},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":897,"title":898,"description":899,"published":900,"category":619,"image":901,"draft":623},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":903,"title":904,"description":905,"published":906,"category":619,"image":907,"draft":623},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":909,"title":910,"description":911,"published":912,"category":721,"image":913,"draft":623},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":915,"title":916,"description":917,"published":918,"category":721,"image":919,"draft":623},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":921,"title":922,"description":923,"published":924,"category":721,"image":925,"draft":623},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":927,"title":928,"description":929,"published":924,"category":619,"image":930,"draft":623},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":932,"title":933,"description":934,"published":935,"category":619,"image":936,"draft":623},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":938,"title":939,"description":940,"published":941,"category":619,"image":942,"draft":623},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":944,"title":945,"description":946,"published":947,"category":721,"image":948,"draft":623},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":950,"title":951,"description":952,"published":953,"category":619,"image":954,"draft":623},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":956,"title":957,"description":958,"published":959,"category":619,"image":960,"draft":623},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":962,"title":963,"description":964,"published":965,"category":619,"image":966,"draft":623},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":968,"title":969,"description":970,"published":971,"category":619,"image":972,"draft":623},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":974,"title":975,"description":976,"published":977,"category":619,"image":978,"draft":623},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":980,"title":981,"description":982,"published":983,"category":619,"image":984,"draft":623},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":986,"title":987,"description":988,"published":989,"category":619,"image":990,"draft":623},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":992,"title":993,"description":994,"published":995,"category":619,"image":996,"draft":623},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":998,"title":999,"description":1000,"published":1001,"category":721,"image":1002,"draft":623},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1004,"title":1005,"description":1006,"published":1007,"category":721,"image":1008,"draft":623},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1010,"title":1011,"description":1012,"published":1013,"category":721,"image":1014,"draft":623},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1016,"title":1017,"description":1018,"published":1019,"category":619,"image":1020,"draft":623},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":1022,"title":1023,"description":1024,"published":1025,"category":619,"image":1026,"draft":623},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1028,"title":1029,"description":1030,"published":1031,"category":619,"image":1032,"draft":623},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1034,"title":1035,"description":1036,"published":1037,"category":619,"image":1038,"draft":623},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1040,"title":1041,"description":1042,"published":1043,"category":619,"image":1044,"draft":623},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1046,"title":1047,"description":1048,"published":1049,"category":619,"image":1050,"draft":623},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1052,"title":1053,"description":1054,"published":1055,"category":619,"image":1056,"draft":623},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1058,"title":1059,"description":1060,"published":1061,"category":619,"image":1062,"draft":623},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1064,"title":1065,"description":1066,"published":1067,"category":619,"image":1068,"draft":623},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1070,"title":1071,"description":1072,"published":1073,"category":619,"image":1074,"draft":623},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1076,"title":1077,"description":1078,"published":1079,"category":721,"image":1080,"draft":623},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1082,"title":1083,"description":1084,"published":1085,"category":619,"image":1086,"draft":623},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1088,"title":1089,"description":1090,"published":1091,"category":721,"image":1092,"draft":623},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1094,"title":1095,"description":1096,"published":1097,"category":619,"image":1098,"draft":623},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1100,"title":1101,"description":1102,"published":1103,"category":619,"image":1104,"draft":623},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1106,"title":1107,"description":1108,"published":1109,"category":619,"image":1110,"draft":623},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1112,"title":1113,"description":1114,"published":1115,"category":619,"image":1116,"draft":623},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1118,"title":1119,"description":1120,"published":1121,"category":721,"image":1122,"draft":623},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1124,"title":1125,"description":1126,"published":1127,"category":721,"image":1128,"draft":623},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1130,"title":1131,"description":1132,"published":1133,"category":619,"image":1134,"draft":623},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1136,"title":1137,"description":1138,"published":1139,"category":619,"image":1140,"draft":623},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1142,"title":1143,"description":1144,"published":1145,"category":721,"image":1146,"draft":623},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1148,"title":1149,"description":1150,"published":1151,"category":619,"image":1152,"draft":623},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1154,"title":1155,"description":1156,"published":1151,"category":619,"image":1157,"draft":623},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1159,"title":1160,"description":1161,"published":1162,"category":619,"image":1163,"draft":623},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1165,"title":1166,"description":1167,"published":1168,"category":721,"image":1169,"draft":623},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1171,"title":1172,"description":1173,"published":1174,"category":619,"image":1175,"draft":623},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1177,"title":1178,"description":1179,"published":1174,"category":721,"image":1180,"draft":623},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1182,"title":1183,"description":1184,"published":1185,"category":721,"image":1186,"draft":623},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1188,"title":1189,"description":1190,"published":1185,"category":619,"image":1191,"draft":623},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]