[{"data":1,"prerenderedAt":863},["ShallowReactive",2],{"blog-en-supabase-backup-tools-compared":3,"blog-index-en":516},{"id":4,"title":5,"body":6,"category":475,"cover":476,"coverAlt":477,"description":478,"draft":479,"extension":480,"faq":481,"image":497,"keywords":498,"meta":504,"navigation":505,"ogTitle":506,"path":507,"published":508,"seo":509,"stem":510,"tldr":511,"updated":508,"__hash__":515},"blog_en\u002Fblog\u002Fsupabase-backup-tools-compared.md","Supabase backup tools compared, including ours",{"type":7,"value":8,"toc":462},"minimark",[9,13,21,24,29,32,163,166,170,173,210,216,220,223,232,235,239,242,249,255,258,285,290,298,302,305,308,311,319,323,326,329,367,372,375,382,386,389,420,424,444],[10,11,12],"p",{},"You went looking for a Supabase backup tool for one of two reasons. Either you\nfound out your project sits on the free plan and nothing has ever been copied\nanywhere, or you are on a paid plan, you read how far its window reaches back,\nand it did not feel like enough for an app with real customers in it.",[10,14,15,16,20],{},"Here is the part these comparisons get wrong, and the ones written by the tools\nthemselves get wrong hardest: they rank the options by feature. ",[17,18,19],"strong",{},"A backup tool\nis something you pay for to cover a job you have already decided you will not do\nyourself."," If you would genuinely do it, the free route makes the same file.",[10,22,23],{},"We sell one of the four below, so read the rest of this with that in hand. For a\ngood number of apps the free route is the right answer, and the section on it is\nthe longest one here.",[25,26,28],"h2",{"id":27},"which-supabase-backup-tool-should-i-use","Which Supabase backup tool should I use?",[10,30,31],{},"Choose by which part of the job you want to stop thinking about. All four routes\nproduce a copy of your database. What separates them is how much of what happens\nnext is still yours.",[33,34,35],"comparison-table",{},[36,37,38,59],"table",{},[39,40,41],"thead",{},[42,43,44,47,50,53,56],"tr",{},[45,46],"th",{},[45,48,49],{},"Supabase's own",[45,51,52],{},"A GitHub Action",[45,54,55],{},"A backup service",[45,57,58],{},"Managed care",[60,61,62,77,91,104,119,132,146],"tbody",{},[42,63,64,68,71,73,75],{},[65,66,67],"td",{},"Runs on a schedule without you",[65,69,70],{},"Yes",[65,72,70],{},[65,74,70],{},[65,76,70],{},[42,78,79,82,85,87,89],{},[65,80,81],{},"The copy leaves your Supabase account",[65,83,84],{},"No",[65,86,70],{},[65,88,70],{},[65,90,70],{},[42,92,93,96,98,100,102],{},[65,94,95],{},"Survives losing the account",[65,97,84],{},[65,99,70],{},[65,101,70],{},[65,103,70],{},[42,105,106,109,111,114,117],{},[65,107,108],{},"Your uploaded files are included",[65,110,84],{},[65,112,113],{},"A second job",[65,115,116],{},"Usually not",[65,118,70],{},[42,120,121,124,126,128,130],{},[65,122,123],{},"Something reads the copy back",[65,125,84],{},[65,127,84],{},[65,129,84],{},[65,131,70],{},[42,133,134,137,140,142,144],{},[65,135,136],{},"Restoring is a button",[65,138,139],{},"Yes, inside the project",[65,141,84],{},[65,143,84],{},[65,145,70],{},[42,147,148,151,154,157,160],{},[65,149,150],{},"Cost",[65,152,153],{},"Paid Supabase plans",[65,155,156],{},"Free",[65,158,159],{},"Free tier, then paid",[65,161,162],{},"A subscription",[10,164,165],{},"The shaded column is ours, and rows four to six are what it sells. Worth holding\nagainst everything below.",[25,167,169],{"id":168},"what-you-are-actually-buying","What you are actually buying",[10,171,172],{},"Four things have to happen for a backup to be worth anything, and every Supabase\nbackup tool here does some of them.",[174,175,176,188,194,200],"ol",{},[177,178,179,182,183,187],"li",{},[17,180,181],{},"Take a copy."," Nothing on this page charges you for this. ",[184,185,186],"code",{},"pg_dump"," ships\nwith Postgres and the Supabase CLI wraps it.",[177,189,190,193],{},[17,191,192],{},"Move it somewhere the original cannot take with it."," A copy inside the\naccount it is protecting covers you the day you break your own data. It is\nstanding behind the same door the day you lose the login.",[177,195,196,199],{},[17,197,198],{},"Read it back."," A dump written while a connection dropped looks exactly\nlike a good one until you try to use it.",[177,201,202,205,206,209],{},[17,203,204],{},"Put it back."," On the worst day of your app's life, in whatever state you\nare in that day, with whatever you happen to know about ",[184,207,208],{},"psql",".",[211,212],"diagram",{"alt":213,"caption":214,"src":215},"Four numbered panels. One: a database with an arrow into a file. Two: a file crossing out of a dashed boundary. Three: a magnifier over the file, with a tick. Four: an arrow carrying the file back into the database.","The four steps every route on this page is a different slice of. Most tools sell you the middle two.","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Ffour-jobs-1600x560.png",[25,217,219],{"id":218},"do-i-need-a-tool-if-i-am-already-on-a-paid-supabase-plan","Do I need a tool if I am already on a paid Supabase plan?",[10,221,222],{},"For the ordinary disaster, no. Supabase takes daily copies on its paid plans and\nrestoring one is a few clicks inside the dashboard, which is the fastest route\nback from a migration that ran twice.",[10,224,225,226,231],{},"What it does not cover is the account. Every copy Supabase takes lives inside\nthe project it protects, so a billing failure, a suspended project or a login\nyou cannot recover puts the backups behind the same door as the thing they were\nthere for.\n",[227,228,230],"a",{"href":229},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Which plan you are on, and how far its window reaches","\ntakes about two minutes to check.",[10,233,234],{},"So turn those on, and then decide separately whether one copy in one place is\nwhere you want to stop.",[25,236,238],{"id":237},"when-a-github-action-beats-paying-anyone","When a GitHub Action beats paying anyone",[10,240,241],{},"When your app already lives in a GitHub repository, you can edit a YAML file\nwithout dread, and your database is small. In that case the free route is a real\nanswer. It makes the same dump a paid service makes, on the same schedule, and\nnobody is billing you.",[10,243,244,245,248],{},"Supabase documents this one itself. A workflow file in ",[184,246,247],{},".github\u002Fworkflows"," runs\nthe Supabase CLI three times, dumping your roles, your schema and your data as\nseparate files on a cron that fires at midnight, then commits the results back\ninto the repository. Their page carries a single warning and carries it twice:\nnever back up your data to a public repository.",[10,250,251,252,254],{},"This is also the route that fixes the thing that kills the by-hand version. A\n",[184,253,186],{}," on your laptop is dated from the last time you thought about it, and\nthe day you need it is never a day you were thinking about it. A scheduled\nworkflow runs whether or not you remembered, and the file lands on a different\ncompany's servers from the one holding your database.",[10,256,257],{},"Four things it leaves you holding:",[259,260,261,267,273,279],"ul",{},[177,262,263,266],{},[17,264,265],{},"The dumps pile up in a repository",", which is a place built for code. A\ngrowing binary history is awkward to work with, and if a real secret ever\nlands in one, taking it back out means rewriting history.",[177,268,269,272],{},[17,270,271],{},"Your connection string sits in CI."," That is a credential with full write\naccess to your database, kept in a system that also runs code from pull\nrequests.",[177,274,275,278],{},[17,276,277],{},"Nobody reads the copy back."," A green workflow run means the job exited\nwithout an error, which is a smaller claim than the file restoring.",[177,280,281,284],{},[17,282,283],{},"Uploaded files need a second job."," The dump holds the row pointing at each\nfile. The files live in Storage and come out separately, on every route here.",[211,286],{"alt":287,"caption":288,"src":289},"A finished job marked with a green tick. One line leaves it and forks into two identical file panels. The upper file's contents fill every row. The lower file's contents stop after two rows and the rest are empty dashed outlines.","Both of these came out of a run that finished without an error. Nothing in the run tells you which one you have.","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fgreen-run-short-file-1600x740.png",[10,291,292,293,297],{},"If you can live with those four, stop reading here and ",[227,294,296],{"href":295},"\u002Fblog\u002Fsupabase-backup-github-action","go and set it\nup",", with the connection string GitHub can\nreach and the schedule your egress allowance can pay for. It costs nothing, and\nthe file it writes is the same file the paid routes write.",[25,299,301],{"id":300},"what-a-paid-backup-service-adds","What a paid backup service adds",[10,303,304],{},"It takes the maintenance off you. A small service connects to your database,\nruns on a schedule you pick, drops the file into storage you already own, and\nputs a screen in front of the whole thing that says when a run failed.",[10,306,307],{},"Supabackup is the one people search for by name. It takes your database\nconnection string, uploads the dumps into a Google Drive account you connect,\nand keeps a set number of them before deleting the oldest. Its own pricing page\ndescribes a free tier that runs weekly and a paid one that runs daily; read the\ncurrent price there rather than here, because it is theirs to change.",[10,309,310],{},"What that buys over the workflow file is something that does not rot. No YAML,\nno repository filling with dumps, no CI secret, and a dashboard telling you the\nlast run failed instead of an email you have learned to skip.",[10,312,313,314,318],{},"What it does not change is the second half of the job. The copy is your\ndatabase, the file is a dump, and on the day you need it you are the one\nreplaying it. Check whether the service you pick covers Storage as well, because\nmuch of this category is the database alone.\n",[227,315,317],{"href":316},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","Restoring a dump has its own steps",",\nand they are worth reading before you need them.",[25,320,322],{"id":321},"what-managed-care-adds-and-what-you-pay-for","What managed care adds, and what you pay for",[10,324,325],{},"It adds the two parts the other three routes leave with you: the check, and the\nrestore.",[10,327,328],{},"That is Reeve Care, and backups are one line on it.",[259,330,331,337,343,349,355,361],{},[177,332,333,336],{},[17,334,335],{},"Several copies a day",", on a schedule your plan sets and nothing you have to\nremember to trigger.",[177,338,339,342],{},[17,340,341],{},"Held outside your Supabase account",", encrypted, so a suspended project or a\nlogin you cannot recover leaves the copies where they are.",[177,344,345,348],{},[17,346,347],{},"Read back before it counts."," Every copy is opened and counted against what\nwent in, which is why the date on your dashboard is the date of the last\nverified one rather than the last attempt.",[177,350,351,354],{},[17,352,353],{},"Your uploaded files alongside your rows",", once you connect a Storage\ncredential, and both go back together.",[177,356,357,360],{},[17,358,359],{},"More than one restore point."," How many depends on the plan, and the oldest\nis pruned as newer ones land.",[177,362,363,366],{},[17,364,365],{},"Putting it back is one button",", and a copy of the current state is taken\nfirst, before anything is replaced.",[211,368],{"alt":369,"caption":370,"src":371},"Three numbered lanes beside the Reeve Care mark. One: a Supabase account holding a database and an uploaded image, a repeat mark over the arrow leaving it, and the copy outside carrying a padlock, a magnifier and a tick. Two: a row of seven saved copies, the oldest drawn dashed and the newest picked out. Three: an arrow carrying a saved copy back into the account, out of a card with a button on it.","What the subscription is doing while you are not thinking about it. The database and the uploads travel together, in both directions.","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcare-in-one-frame-1600x700.png",[10,373,374],{},"What you pay for is availability. You can start a restore at any hour, from any\nnight your plan still keeps, without waiting until you have a free afternoon.\nEvery copy is encrypted before it leaves your project and held that way. Care\nMax adds priority support, and somebody to help you apply a fix.",[10,376,377,378,209],{},"The copy leaving Supabase, the check that follows it and the button that puts it\nback are drawn out on ",[227,379,381],{"href":380},"\u002Fsupabase-backups","the Supabase backups page",[25,383,385],{"id":384},"how-to-choose-in-about-a-minute","How to choose, in about a minute",[10,387,388],{},"Four branches, and most people land in the first two.",[259,390,391,397,408,414],{},[177,392,393,396],{},[17,394,395],{},"Free plan, and editing a YAML file does not frighten you."," The GitHub\nAction. Free, complete, and yours.",[177,398,399,402,403,407],{},[17,400,401],{},"Free plan, and it does."," A small backup service, or\n",[227,404,406],{"href":405},"\u002Fblog\u002Fback-up-supabase-free-tier","a copy made from the dashboard by hand","\nuntil you are ready for something scheduled.",[177,409,410,413],{},[17,411,412],{},"Paid plan, and you want a copy outside the account."," Either of the above,\non top of what Supabase already takes.",[177,415,416,419],{},[17,417,418],{},"Real customers, uploaded files, and nobody who will be running a restore\nunder pressure."," Managed.",[25,421,423],{"id":422},"what-to-do-this-week","What to do this week",[425,426,427],"key-takeaways",{},[259,428,429,432,435,438,441],{},[177,430,431],{},"Turn on whatever your Supabase plan already includes. It costs nothing extra and it is the fastest way back from your own mistakes.",[177,433,434],{},"Pick one route from this page that puts a copy outside your Supabase account, and set it up today.",[177,436,437],{},"Whatever you picked, restore from it once into a throwaway project. Until you have, what you own is a file of unknown quality.",[177,439,440],{},"Copy your Storage files on a job of their own. No route here includes them by default.",[177,442,443],{},"Write down where the copies land and which login reaches them. A line in your project's README is enough, and it is the note you will be hunting for at midnight.",[10,445,446,447,451,452,456,457,461],{},"If a table has ever gone empty on you for a reason nobody could explain, read\n",[227,448,450],{"href":449},"\u002Fblog\u002Fversion-history-is-not-a-backup","what a rollback actually restores","\nfirst, then\n",[227,453,455],{"href":454},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","three ways to back up a Supabase database","\nfor what a copy holds and what it leaves behind. And if you would rather see\nwhat else is open on your app before you decide where to spend,\n",[227,458,460],{"href":459},"\u002Fsecurity-scanner","the free scan"," reads your live site in about 20 seconds.",{"title":463,"searchDepth":464,"depth":464,"links":465},"",3,[466,468,469,470,471,472,473,474],{"id":27,"depth":467,"text":28},2,{"id":168,"depth":467,"text":169},{"id":218,"depth":467,"text":219},{"id":237,"depth":467,"text":238},{"id":300,"depth":467,"text":301},{"id":321,"depth":467,"text":322},{"id":384,"depth":467,"text":385},{"id":422,"depth":467,"text":423},"Backups","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcover-1200x630.png","A database beside four saved copies of it standing in a row, with the third of the four raised above the others.","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.",false,"md",[482,485,488,491,494],{"q":483,"a":484},"What is the best Supabase backup tool?","There is no single answer, because the four routes cover different parts of the same job. Supabase's own backups are the fastest to turn on and they live inside the account they are protecting. A GitHub Action is free and complete, and it leaves the checking and the restoring with you. A small backup service takes the maintenance off you. A managed service adds the verification, your uploaded files and a restore somebody else can run. Pick by which of those parts you want to stop holding.",{"q":486,"a":487},"Is there a free Supabase backup tool?","Yes, more than one. The Supabase CLI dumps your database to a file on your own machine and costs nothing. A GitHub Action running that same CLI on a schedule costs nothing either, as long as the repository it writes into is private. Several paid services also have a free tier, usually one job on a weekly schedule. What no free route includes is anybody checking that the file opens.",{"q":489,"a":490},"Can I back up Supabase with a GitHub Action?","Yes, and Supabase documents the workflow itself. It runs the CLI three times to dump your roles, your schema and your data separately, on a cron that fires at midnight, and commits the files back into the repository. Their page carries one warning and carries it twice: never back up your data to a public repository. Worth deciding early is whether a growing pile of dumps belongs in a code repository at all, or whether the same workflow should upload them somewhere else.",{"q":492,"a":493},"Do Supabase backup tools include Storage files?","Some do and many do not, so find out before you assume. A database dump holds the row recording where each file was kept and nothing of the file itself, which is how a restore finishes cleanly and leaves an app full of broken images. Whichever route you pick, check whether uploaded files are part of it, and if they are not, copy them on a job of their own.",{"q":495,"a":496},"What should I look for in a Supabase backup tool?","Four questions, in this order. Does the copy leave your Supabase account, or does it sit inside the thing it is protecting? Does anything read the copy back, or does a green run count as success? Are your uploaded files part of it? And on the day you need it, who runs the restore? Price belongs last rather than first, because the routes that cost nothing are genuinely good at the first half of that list.","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",[499,500,501,502,503],"supabase backup tool","supabackup","automatic supabase backup","supabase backup service","supabase backup tools compared",{},true,"Supabase backup tools compared","\u002Fblog\u002Fsupabase-backup-tools-compared","2026-09-01",{"title":5,"description":478},"blog\u002Fsupabase-backup-tools-compared",[512,513,514],"A Supabase backup tool is worth paying for when the part that fails is you remembering. Every route on this page makes the same file.","Four of them: Supabase's own backups, a scheduled GitHub Action, a small backup service, and managed care. They differ in how much of the job stays yours.","None of them counts for anything until someone has read a copy back, and that is the row missing from every feature list.","kZks7WObdNdRx_DvbXpYY4q2-e06B6znLQaPXiEQ3fI",[517,524,530,536,542,548,554,560,566,572,578,584,590,596,601,607,612,618,624,630,636,642,648,654,660,666,672,678,684,690,696,702,708,714,720,726,732,738,744,750,756,757,763,768,774,780,786,792,798,803,809,815,821,827,832,838,843,849,853,858],{"path":518,"title":519,"description":520,"published":521,"category":522,"image":523,"draft":479},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","Security basics","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":525,"title":526,"description":527,"published":528,"category":522,"image":529,"draft":479},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":531,"title":532,"description":533,"published":534,"category":522,"image":535,"draft":479},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":537,"title":538,"description":539,"published":540,"category":522,"image":541,"draft":479},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":543,"title":544,"description":545,"published":546,"category":522,"image":547,"draft":479},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":549,"title":550,"description":551,"published":552,"category":522,"image":553,"draft":479},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":555,"title":556,"description":557,"published":558,"category":522,"image":559,"draft":479},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":561,"title":562,"description":563,"published":564,"category":522,"image":565,"draft":479},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":567,"title":568,"description":569,"published":570,"category":522,"image":571,"draft":479},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":573,"title":574,"description":575,"published":576,"category":522,"image":577,"draft":479},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":579,"title":580,"description":581,"published":582,"category":522,"image":583,"draft":479},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":585,"title":586,"description":587,"published":588,"category":522,"image":589,"draft":479},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":591,"title":592,"description":593,"published":594,"category":475,"image":595,"draft":479},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":295,"title":597,"description":598,"published":599,"category":475,"image":600,"draft":479},"Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":602,"title":603,"description":604,"published":605,"category":475,"image":606,"draft":479},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":608,"title":609,"description":610,"published":605,"category":522,"image":611,"draft":479},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":613,"title":614,"description":615,"published":616,"category":522,"image":617,"draft":479},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":619,"title":620,"description":621,"published":622,"category":522,"image":623,"draft":479},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":625,"title":626,"description":627,"published":628,"category":475,"image":629,"draft":479},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":631,"title":632,"description":633,"published":634,"category":522,"image":635,"draft":479},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":637,"title":638,"description":639,"published":640,"category":522,"image":641,"draft":479},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":643,"title":644,"description":645,"published":646,"category":522,"image":647,"draft":479},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":649,"title":650,"description":651,"published":652,"category":522,"image":653,"draft":479},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":655,"title":656,"description":657,"published":658,"category":522,"image":659,"draft":479},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":661,"title":662,"description":663,"published":664,"category":522,"image":665,"draft":479},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":667,"title":668,"description":669,"published":670,"category":522,"image":671,"draft":479},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":673,"title":674,"description":675,"published":676,"category":522,"image":677,"draft":479},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":679,"title":680,"description":681,"published":682,"category":475,"image":683,"draft":479},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":685,"title":686,"description":687,"published":688,"category":475,"image":689,"draft":479},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":691,"title":692,"description":693,"published":694,"category":475,"image":695,"draft":479},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":697,"title":698,"description":699,"published":700,"category":522,"image":701,"draft":479},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":703,"title":704,"description":705,"published":706,"category":522,"image":707,"draft":479},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":709,"title":710,"description":711,"published":712,"category":522,"image":713,"draft":479},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":715,"title":716,"description":717,"published":718,"category":522,"image":719,"draft":479},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":721,"title":722,"description":723,"published":724,"category":522,"image":725,"draft":479},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Ten tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":727,"title":728,"description":729,"published":730,"category":522,"image":731,"draft":479},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":733,"title":734,"description":735,"published":736,"category":522,"image":737,"draft":479},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":739,"title":740,"description":741,"published":742,"category":522,"image":743,"draft":479},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":745,"title":746,"description":747,"published":748,"category":522,"image":749,"draft":479},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":751,"title":752,"description":753,"published":754,"category":522,"image":755,"draft":479},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":507,"title":5,"description":478,"published":508,"category":475,"image":497,"draft":479},{"path":758,"title":759,"description":760,"published":761,"category":522,"image":762,"draft":479},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":405,"title":764,"description":765,"published":766,"category":475,"image":767,"draft":479},"Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":769,"title":770,"description":771,"published":772,"category":522,"image":773,"draft":479},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":775,"title":776,"description":777,"published":778,"category":522,"image":779,"draft":479},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":781,"title":782,"description":783,"published":784,"category":522,"image":785,"draft":479},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":787,"title":788,"description":789,"published":790,"category":522,"image":791,"draft":479},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":793,"title":794,"description":795,"published":796,"category":475,"image":797,"draft":479},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":316,"title":799,"description":800,"published":801,"category":475,"image":802,"draft":479},"How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":804,"title":805,"description":806,"published":807,"category":522,"image":808,"draft":479},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":810,"title":811,"description":812,"published":813,"category":522,"image":814,"draft":479},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":816,"title":817,"description":818,"published":819,"category":475,"image":820,"draft":479},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":822,"title":823,"description":824,"published":825,"category":522,"image":826,"draft":479},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":828,"title":829,"description":830,"published":825,"category":522,"image":831,"draft":479},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":833,"title":834,"description":835,"published":836,"category":522,"image":837,"draft":479},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase's new API keys: which one is safe in your app?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":229,"title":839,"description":840,"published":841,"category":475,"image":842,"draft":479},"Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":844,"title":845,"description":846,"published":847,"category":522,"image":848,"draft":479},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":449,"title":850,"description":851,"published":847,"category":475,"image":852,"draft":479},"Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":454,"title":854,"description":855,"published":856,"category":475,"image":857,"draft":479},"Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":859,"title":860,"description":861,"published":856,"category":522,"image":862,"draft":479},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1791618966336]