[{"data":1,"prerenderedAt":990},["ShallowReactive",2],{"blog-en-supabase-bucket-not-found":3,"blog-index-en":459},{"id":4,"title":5,"body":6,"category":416,"cover":417,"coverAlt":418,"description":419,"draft":420,"extension":421,"faq":422,"image":438,"keywords":439,"meta":447,"navigation":448,"ogTitle":5,"path":449,"published":450,"seo":451,"stem":452,"tldr":453,"updated":450,"__hash__":458},"blog_en\u002Fblog\u002Fsupabase-bucket-not-found.md","Supabase \"Bucket not found\": the three things it means",{"type":7,"value":8,"toc":403},"minimark",[9,13,16,27,30,38,43,46,49,75,78,100,104,107,112,118,121,132,135,141,145,163,166,169,175,179,182,191,194,209,214,218,221,224,227,238,242,245,255,269,272,276,279,291,298,302,305,314,332,341,358,362,390],[10,11,12],"p",{},"Your app shows a broken picture where a photo should be. Or an upload fails, and\nthe message that comes back is three words long: \"Bucket not found\". Then you\nopen Supabase, go to Storage, and the bucket is right there in the list.",[10,14,15],{},"Open the picture's address in a tab of its own and Storage answers with this:",[17,18,23],"pre",{"className":19,"code":21,"language":22},[20],"language-text","{\n  \"statusCode\": \"404\",\n  \"code\": \"NoSuchBucket\",\n  \"error\": \"Bucket not found\",\n  \"message\": \"Bucket not found\"\n}\n","text",[24,25,21],"code",{"__ignoreMap":26},"",[10,28,29],{},"That is the body Supabase Storage's own source builds today, read on 17 October\n2026. Supabase \"Bucket not found\" covers three different situations with that\none body, and in the first of them the bucket is exactly where you left it.",[10,31,32,33,37],{},"Here is the part that guide after guide gets wrong: ",[34,35,36],"strong",{},"the first fix you will\nfind is to make the bucket public, and when it works, it works by making every\nfile in that bucket public too."," For two of the three causes it changes nothing\nat all. For the remaining one it trades a broken picture for a bucket that\nanyone holding a file address can read from.",[39,40,42],"h2",{"id":41},"what-does-supabase-bucket-not-found-mean","What does Supabase \"Bucket not found\" mean?",[10,44,45],{},"Storage looked for a bucket with exactly the name in your request, inside the\nproject your request reached, and found none that it would serve to that\nrequest.",[10,47,48],{},"That last clause is there because a bucket has more than one door, and each\ndoor asks the question in its own way. Storage's source code shows three of\nthem:",[50,51,52,63,69],"ul",{},[53,54,55,58,59,62],"li",{},[34,56,57],{},"A public file address",", the kind ",[24,60,61],{},"getPublicUrl"," makes. This door only\ncounts buckets marked public, so a private bucket is \"not found\" here even\nthough it exists.",[53,64,65,68],{},[34,66,67],{},"An upload."," This door counts every bucket in the project, private ones\nincluded. \"Not found\" here means that name really is absent from that\nproject.",[53,70,71,74],{},[34,72,73],{},"A request for the list of a bucket's files."," This door never says \"Bucket\nnot found\". A bucket that does not exist answers with an empty list, the same\nanswer an empty bucket gives, which we see from outside every time our scanner\nasks.",[10,76,77],{},"So the first job is to work out which door the failing request used.",[10,79,80,83,84,87,88,91,92,95,96,99],{},[34,81,82],{},"The two numbers in that message disagree, and that trips up error handling.","\nThe body says ",[24,85,86],{},"\"statusCode\": \"404\"",", while the request itself fails with HTTP\nstatus 400. Storage sends this error with a 400 and keeps its own 404 inside the\nbody. The supabase-js library passes both through to your code: ",[24,89,90],{},"error.status","\nis 400 and ",[24,93,94],{},"error.statusCode"," is ",[24,97,98],{},"\"404\"",". Code your builder wrote to catch a 404\nwill let this one straight past.",[39,101,103],{"id":102},"cause-1-a-public-link-to-a-private-bucket","Cause 1: a public link to a private bucket",[10,105,106],{},"This is the one behind broken pictures. The address was built for a public\nbucket, and the bucket is private.",[10,108,109,111],{},[24,110,61],{}," asks Supabase nothing. It joins your project's address, the\nbucket name and the file name into a link, inside your app, and hands it back.\nThe note above that function in Supabase's own client library says so in two\nsentences:",[113,114,115],"blockquote",{},[10,116,117],{},"This function does not verify if the bucket is public. If a public URL is\ncreated for a bucket which is not public, you will not be able to download the\nasset.",[10,119,120],{},"Later a visitor's browser asks for that link, and Storage looks for the bucket\namong public buckets only. A private bucket fails that lookup exactly as a\nmissing one would, and the answer is \"Bucket not found\".",[10,122,123,124,127,128,131],{},"You can recognise this cause from the link itself. A public file address\ncontains ",[24,125,126],{},"\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002F"," followed by the bucket name. If that\nbucket carries no public label in ",[34,129,130],{},"Storage → Buckets",", the link was never\ngoing to open, however the name is spelled.",[10,133,134],{},"New buckets start private, so the setting is behaving as designed. What\nhappened is that you or your builder wrote code for a public bucket and pointed\nit at a private one.",[136,137],"diagram",{"alt":138,"caption":139,"src":140},"A store of pictures with a lock badge and two openings in its left wall. A card marked getPublicUrl sends an amber arrow into the upper opening, which has a bar across it and a cross above. A card marked createSignedUrl sends a teal arrow into the lower opening, whose bar is lifted, and a picture leaves the far side of the store towards a person beside a tick.","One private bucket, two ways of asking for a file. The public address is turned away at the door, and the signed link is let through to the same file.","\u002Fblog\u002Fsupabase-bucket-not-found\u002Ftwo-doors-1600x720.png",[39,142,144],{"id":143},"cause-2-a-name-that-is-not-quite-the-buckets-name","Cause 2: a name that is not quite the bucket's name",[10,146,147,148,151,152,155,156,159,160,162],{},"Storage compares the bucket name character for character, so ",[24,149,150],{},"Avatars"," and\n",[24,153,154],{},"avatars"," are two different buckets, and so are ",[24,157,158],{},"avatar"," and ",[24,161,154],{},".",[10,164,165],{},"In Storage's source the lookup is a plain equality on the bucket's id. Capitals\ncount, a missing letter counts, and a hyphen where the bucket has an underscore\ncounts. Each of those comes back as the same three words.",[10,167,168],{},"An app built with an AI tool can get here without anybody mistyping anything.\nThe code that uploads or shows a file is written in one step, and the bucket it\nnames is supposed to be created in another. If that second step never ran, or\nran with a slightly different name, the code is asking for a bucket nobody\nmade.",[10,170,171,172,174],{},"Checking it takes two lists. Open ",[34,173,130],{}," and note each bucket's\nname exactly as it appears. Then tell your builder, in plain words: list every\nStorage bucket name this app uses, and show me where each one is used. Any name\non its list that is missing from yours is the one failing.",[39,176,178],{"id":177},"cause-3-the-bucket-is-in-another-project","Cause 3: the bucket is in another project",[10,180,181],{},"Your app talks to exactly one Supabase project, the one in its Supabase address,\nand a bucket made in any other project does not exist as far as your app is\nconcerned.",[10,183,184,185,190],{},"An upload is where this cause shows most clearly. On an upload Storage looks the\nbucket up across the whole project without applying your access rules, so\n\"Bucket not found\" on an upload is never a permissions problem. When the bucket\nexists and your rules refuse the file, Storage answers with\n",[186,187,189],"a",{"href":188},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","a different message about row-level security",".\nSo \"Bucket not found\" on an upload means that name is absent from the project\nyour app is writing to.",[10,192,193],{},"There are ordinary ways to end up with two projects: a test project beside the\nlive one, a copy of the app connected to a fresh project, a project made by hand\nto try something out. The bucket gets created in whichever one happened to be\nopen in the dashboard at the time.",[10,195,196,197,200,201,204,205,208],{},"The check is a comparison of two short strings. Your app's Supabase address\nlooks like ",[24,198,199],{},"https:\u002F\u002F\u003Cref>.supabase.co",", and the part before ",[24,202,203],{},".supabase.co"," is\nthe project's reference. Your dashboard's own address carries the same\nreference after ",[24,206,207],{},"\u002Fproject\u002F",". If the two differ, you are looking at one project\nwhile your app talks to another.",[136,210],{"alt":211,"caption":212,"src":213},"An app window on the left with a teal arrow into the project whose reference matches its own. That project holds two dim buckets and a dashed outline where a third should be, marked with an amber cross. To the right, a separate project with a different reference holds the bucket itself, lit in teal, with nothing connecting it to the app.","The bucket exists. It was made in the project on the right, and every request your app sends goes to the one on the left.","\u002Fblog\u002Fsupabase-bucket-not-found\u002Ftwo-projects-1600x700.png",[39,215,217],{"id":216},"should-you-make-the-bucket-public-to-fix-it","Should you make the bucket public to fix it?",[10,219,220],{},"Only when every file in the bucket is meant for anyone who has its address, and\nonly for the first cause. For a wrong name or a wrong project, the toggle\nchanges nothing.",[10,222,223],{},"A public bucket does one thing, and Supabase's documentation describes it in\none line: anyone who possesses a file's address can open it. No sign-in is\ninvolved. Supabase's own examples of where that fits are profile pictures,\npublic media and blog post content, and logos or product photos belong in the\nsame group.",[10,225,226],{},"It is the wrong setting for invoices, ID scans, exports, or anything that\nbelongs to one person. The toggle covers the whole bucket and every file that\nlands in it later, including files from a feature you have yet to build.",[10,228,229,230,233,234,237],{},"The same shortcut has a twin on the rules side, and it is the one we measure.\nA rule on ",[24,231,232],{},"storage.objects"," that names only the bucket makes downloads work for\neverybody, and it also hands out the list of names in the bucket. We have\nscanned 8,435 live apps that name a Supabase project. The bucket check got an\nanswer from 4,703 of them, and ",[34,235,236],{},"792 answered a list request from us with the\nnames of what was inside",", with nobody signed in. That is about one in six of\nthe apps we could ask. When a bucket is public and its list is open as well,\nevery name on that list is a working link.",[39,239,241],{"id":240},"how-to-show-a-private-file-without-making-it-public","How to show a private file without making it public",[10,243,244],{},"Give the page a signed link: an address that works for a number of seconds you\nchoose and then stops working.",[10,246,247,248,251,252,254],{},"Supabase's documentation names two ways to get a file out of a private bucket.\nOne is a download that carries the signed-in person's session. The other is\n",[24,249,250],{},"createSignedUrl",", which makes a link \"that can be accessed for a limited time\".\nThat second one takes the place of ",[24,253,61],{}," wherever a page shows a\npicture.",[10,256,257,258,261,262,264,265,268],{},"A signed link still answers to your rules. Before Storage signs anything, its\nsource checks that the person asking is allowed to read that file, so a private\nbucket needs a ",[24,259,260],{},"select"," rule on ",[24,263,232],{}," saying who may read what.\n",[186,266,267],{"href":188},"The upload error explains how those rules are written",",\nincluding why a read rule that names only the bucket opens its list as well.",[10,270,271],{},"To hand this to your builder, in plain words: for the bucket behind the \"Bucket\nnot found\" error, replace getPublicUrl with createSignedUrl, keep the bucket\nprivate, and add a storage policy that lets each person read only the files\nthey are meant to see. Then reload the page that had the broken picture.",[39,273,275],{"id":274},"what-your-buckets-are-showing-strangers-right-now","What your buckets are showing strangers right now",[10,277,278],{},"Two screens in the dashboard tell you what you set, and one check from outside\ntells you what a stranger gets.",[10,280,281,283,284,287,288,290],{},[34,282,130],{}," shows which buckets are public. For each public one, ask\nwhether every file in it is something you would show a stranger. ",[34,285,286],{},"Storage →\nPolicies"," shows the rules. A ",[24,289,260],{}," rule whose only condition is the bucket\nname lets anyone read that bucket, its list of files included.",[10,292,293,294,162],{},"Our free scan asks your live project for each bucket's list of files using only\nthe key already in your app's code, the way a stranger would, and tells you\nwhich buckets answered with names. It reads names and never downloads a file. It\ntakes about 20 seconds and needs no account:\n",[186,295,297],{"href":296},"\u002Fsecurity-scanner","scan your app",[39,299,301],{"id":300},"keeping-your-files-where-you-put-them","Keeping your files where you put them",[10,303,304],{},"Two things can still move after today's fix: a setting gets flipped while\nsomebody chases a different bug, and a file somebody needed gets deleted.",[10,306,307],{},[34,308,309,313],{},[186,310,312],{"href":311},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking from outside:",[50,315,316,319,322,329],{},[53,317,318],{},"the full security check, run again on a schedule, the bucket listing check included",[53,320,321],{},"whether your app is up",[53,323,324,325,328],{},"a message when a result ",[34,326,327],{},"changes",", so a bucket that opened overnight does not wait for you to look",[53,330,331],{},"a monthly report, in plain language, of what it saw",[10,333,334],{},[34,335,336,340],{},[186,337,339],{"href":338},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of what is in there:",[50,342,343,346,349,352,355],{},[53,344,345],{},"an encrypted copy of your Supabase database on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[53,347,348],{},"each copy verified before it counts, by counting the rows in every table",[53,350,351],{},"your uploaded files as well, once you connect a Storage credential",[53,353,354],{},"a one-click restore, with a safety copy of the current state taken first",[53,356,357],{},"everything Monitor does",[39,359,361],{"id":360},"what-to-do-today","What to do today",[363,364,365],"key-takeaways",{},[50,366,367,373,376,379,382],{},[53,368,369,370,372],{},"Open the failing link in a tab of its own. If the address contains ",[24,371,126],{}," and the bucket is private, it is the first cause.",[53,374,375],{},"Copy the bucket's name from Storage → Buckets and compare it, capitals included, with the name your app uses.",[53,377,378],{},"Compare the project reference in your app's Supabase address with the one in your dashboard's address.",[53,380,381],{},"Keep a bucket private unless every file in it is meant for anyone with its address, and serve private files through signed links.",[53,383,384,385,261,387,389],{},"Read every ",[24,386,260],{},[24,388,232],{},". One that names only the bucket hands out the list of files as well.",[10,391,392,393,397,398,402],{},"Start with the request that failed, because the door it used tells you which of\nthe three causes to check. The ",[186,394,396],{"href":395},"\u002Fchecklist","10-minute security checklist"," covers\nwhat else a newly launched app tends to leave open, and\n",[186,399,401],{"href":400},"\u002Fblog\u002Fsupabase-storage-bucket-public","what a public bucket exposes"," is\nthe next read if any of yours turned out to be public.",{"title":26,"searchDepth":404,"depth":404,"links":405},3,[406,408,409,410,411,412,413,414,415],{"id":41,"depth":407,"text":42},2,{"id":102,"depth":407,"text":103},{"id":143,"depth":407,"text":144},{"id":177,"depth":407,"text":178},{"id":216,"depth":407,"text":217},{"id":240,"depth":407,"text":241},{"id":274,"depth":407,"text":275},{"id":300,"depth":407,"text":301},{"id":360,"depth":407,"text":361},"Security basics","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcover-1200x630.png","A shelf of buckets, one shut with a lock. In front of it, an amber address tag whose dashed line stops at a bar short of it.","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.",false,"md",[423,426,429,432,435],{"q":424,"a":425},"Why does Supabase say my bucket is not found when I can see it?","Because Storage looks for a bucket differently depending on the request. A public file address, the kind getPublicUrl makes, is only looked up among public buckets, so a private bucket you can see in the dashboard is reported as not found there. If the error came from an upload instead, the name in your code is not an exact match for any bucket in the project your app is connected to.",{"q":427,"a":428},"Is a Supabase bucket name case-sensitive?","Yes. Storage compares the name character for character, so Avatars and avatars are two different buckets, and so are avatar and avatars. Copy the name from Storage → Buckets in your dashboard and compare it with the name your app uses.",{"q":430,"a":431},"Should I make my bucket public to fix \"Bucket not found\"?","Only if every file in it is meant for anyone who has its address, such as profile pictures or product photos. Public means anyone holding a file address can open that file without signing in. It clears the error only when a public link was made for a private bucket; a wrong name or a wrong project stays broken either way. For files that belong to one person, keep the bucket private and use a signed link.",{"q":433,"a":434},"How do I show a file from a private bucket?","With a signed link. createSignedUrl makes an address that works for a number of seconds you choose and then stops, and it takes the place of getPublicUrl wherever a page shows the file. The person asking for the link must be allowed to read the file, so the bucket needs a select rule on storage.objects that says who may read what.",{"q":436,"a":437},"Why does the error say 404 when the request failed with 400?","Supabase Storage sends this error with HTTP status 400 and puts its own status, 404, inside the body as statusCode. In supabase-js that arrives as error.status 400 and error.statusCode \"404\", which is why code written to catch a 404 lets this error straight through.","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",[440,441,442,443,444,445,446],"supabase bucket not found","supabase storage bucket not found","bucket not found getpublicurl","supabase public url bucket not found","supabase upload bucket not found","supabase storage 404","supabase signed url private bucket",{},true,"\u002Fblog\u002Fsupabase-bucket-not-found","2026-10-17",{"title":5,"description":419},"blog\u002Fsupabase-bucket-not-found",[454,455,456,457],"Supabase \"Bucket not found\" means Storage looked for a bucket with that exact name, in the project your request reached, and found none it would serve to that request. The bucket can still be sitting in your dashboard.","A link made by getPublicUrl for a private bucket gives this error when it is opened, because Storage serves those links from public buckets only.","On an upload it means the name is missing from that project. Check the spelling and the capitals, then which project your app points at.","Making the bucket public ends the message and lets anyone holding a file address open that file. For files that belong to one person, use a signed link.","97sLgMFHY_OzDHTMSJUwzBP4qx0SLdcN2XVzc8DSJmU",[460,466,472,478,484,490,496,502,508,514,520,527,533,539,545,551,557,563,569,575,581,587,593,599,600,606,612,618,624,630,635,641,647,653,659,665,671,677,683,689,695,701,707,713,719,725,730,736,742,748,754,760,766,772,778,784,790,796,802,808,814,820,826,832,838,844,850,856,862,868,874,880,886,892,898,904,910,916,922,928,933,939,945,951,956,962,968,974,979,985],{"path":461,"title":462,"description":463,"published":464,"category":416,"image":465,"draft":420},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":467,"title":468,"description":469,"published":470,"category":416,"image":471,"draft":420},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":473,"title":474,"description":475,"published":476,"category":416,"image":477,"draft":420},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":479,"title":480,"description":481,"published":482,"category":416,"image":483,"draft":420},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":485,"title":486,"description":487,"published":488,"category":416,"image":489,"draft":420},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":491,"title":492,"description":493,"published":494,"category":416,"image":495,"draft":420},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":497,"title":498,"description":499,"published":500,"category":416,"image":501,"draft":420},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":503,"title":504,"description":505,"published":506,"category":416,"image":507,"draft":420},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":509,"title":510,"description":511,"published":512,"category":416,"image":513,"draft":420},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":515,"title":516,"description":517,"published":518,"category":416,"image":519,"draft":420},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":521,"title":522,"description":523,"published":524,"category":525,"image":526,"draft":420},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":528,"title":529,"description":530,"published":531,"category":416,"image":532,"draft":420},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":534,"title":535,"description":536,"published":537,"category":416,"image":538,"draft":420},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":540,"title":541,"description":542,"published":543,"category":416,"image":544,"draft":420},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":546,"title":547,"description":548,"published":549,"category":416,"image":550,"draft":420},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":552,"title":553,"description":554,"published":555,"category":416,"image":556,"draft":420},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":558,"title":559,"description":560,"published":561,"category":416,"image":562,"draft":420},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":564,"title":565,"description":566,"published":567,"category":416,"image":568,"draft":420},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":570,"title":571,"description":572,"published":573,"category":416,"image":574,"draft":420},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":576,"title":577,"description":578,"published":579,"category":416,"image":580,"draft":420},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":582,"title":583,"description":584,"published":585,"category":416,"image":586,"draft":420},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":588,"title":589,"description":590,"published":591,"category":416,"image":592,"draft":420},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":594,"title":595,"description":596,"published":597,"category":416,"image":598,"draft":420},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":449,"title":5,"description":419,"published":450,"category":416,"image":438,"draft":420},{"path":601,"title":602,"description":603,"published":604,"category":416,"image":605,"draft":420},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":607,"title":608,"description":609,"published":610,"category":416,"image":611,"draft":420},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":613,"title":614,"description":615,"published":616,"category":416,"image":617,"draft":420},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":619,"title":620,"description":621,"published":622,"category":416,"image":623,"draft":420},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":625,"title":626,"description":627,"published":628,"category":416,"image":629,"draft":420},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":188,"title":631,"description":632,"published":633,"category":416,"image":634,"draft":420},"\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":636,"title":637,"description":638,"published":639,"category":416,"image":640,"draft":420},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":642,"title":643,"description":644,"published":645,"category":416,"image":646,"draft":420},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":648,"title":649,"description":650,"published":651,"category":416,"image":652,"draft":420},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":654,"title":655,"description":656,"published":657,"category":416,"image":658,"draft":420},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":660,"title":661,"description":662,"published":663,"category":416,"image":664,"draft":420},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":666,"title":667,"description":668,"published":669,"category":416,"image":670,"draft":420},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":672,"title":673,"description":674,"published":675,"category":416,"image":676,"draft":420},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":678,"title":679,"description":680,"published":681,"category":416,"image":682,"draft":420},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":684,"title":685,"description":686,"published":687,"category":416,"image":688,"draft":420},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":690,"title":691,"description":692,"published":693,"category":416,"image":694,"draft":420},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":696,"title":697,"description":698,"published":699,"category":416,"image":700,"draft":420},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":702,"title":703,"description":704,"published":705,"category":416,"image":706,"draft":420},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":708,"title":709,"description":710,"published":711,"category":525,"image":712,"draft":420},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":714,"title":715,"description":716,"published":717,"category":525,"image":718,"draft":420},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":720,"title":721,"description":722,"published":723,"category":525,"image":724,"draft":420},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":726,"title":727,"description":728,"published":723,"category":416,"image":729,"draft":420},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":731,"title":732,"description":733,"published":734,"category":416,"image":735,"draft":420},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":737,"title":738,"description":739,"published":740,"category":416,"image":741,"draft":420},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":743,"title":744,"description":745,"published":746,"category":525,"image":747,"draft":420},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":749,"title":750,"description":751,"published":752,"category":416,"image":753,"draft":420},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":755,"title":756,"description":757,"published":758,"category":416,"image":759,"draft":420},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":761,"title":762,"description":763,"published":764,"category":416,"image":765,"draft":420},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":767,"title":768,"description":769,"published":770,"category":416,"image":771,"draft":420},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":773,"title":774,"description":775,"published":776,"category":416,"image":777,"draft":420},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":779,"title":780,"description":781,"published":782,"category":416,"image":783,"draft":420},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":785,"title":786,"description":787,"published":788,"category":416,"image":789,"draft":420},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":791,"title":792,"description":793,"published":794,"category":416,"image":795,"draft":420},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":797,"title":798,"description":799,"published":800,"category":525,"image":801,"draft":420},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":803,"title":804,"description":805,"published":806,"category":525,"image":807,"draft":420},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":809,"title":810,"description":811,"published":812,"category":525,"image":813,"draft":420},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":815,"title":816,"description":817,"published":818,"category":416,"image":819,"draft":420},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":821,"title":822,"description":823,"published":824,"category":416,"image":825,"draft":420},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":827,"title":828,"description":829,"published":830,"category":416,"image":831,"draft":420},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":833,"title":834,"description":835,"published":836,"category":416,"image":837,"draft":420},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":839,"title":840,"description":841,"published":842,"category":416,"image":843,"draft":420},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":845,"title":846,"description":847,"published":848,"category":416,"image":849,"draft":420},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":851,"title":852,"description":853,"published":854,"category":416,"image":855,"draft":420},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":857,"title":858,"description":859,"published":860,"category":416,"image":861,"draft":420},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":863,"title":864,"description":865,"published":866,"category":416,"image":867,"draft":420},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":869,"title":870,"description":871,"published":872,"category":416,"image":873,"draft":420},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":875,"title":876,"description":877,"published":878,"category":525,"image":879,"draft":420},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":881,"title":882,"description":883,"published":884,"category":416,"image":885,"draft":420},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":887,"title":888,"description":889,"published":890,"category":525,"image":891,"draft":420},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":893,"title":894,"description":895,"published":896,"category":416,"image":897,"draft":420},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":899,"title":900,"description":901,"published":902,"category":416,"image":903,"draft":420},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":905,"title":906,"description":907,"published":908,"category":416,"image":909,"draft":420},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":911,"title":912,"description":913,"published":914,"category":416,"image":915,"draft":420},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":917,"title":918,"description":919,"published":920,"category":525,"image":921,"draft":420},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":923,"title":924,"description":925,"published":926,"category":525,"image":927,"draft":420},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":400,"title":929,"description":930,"published":931,"category":416,"image":932,"draft":420},"Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":934,"title":935,"description":936,"published":937,"category":416,"image":938,"draft":420},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":940,"title":941,"description":942,"published":943,"category":525,"image":944,"draft":420},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":946,"title":947,"description":948,"published":949,"category":416,"image":950,"draft":420},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":952,"title":953,"description":954,"published":949,"category":416,"image":955,"draft":420},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":957,"title":958,"description":959,"published":960,"category":416,"image":961,"draft":420},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":963,"title":964,"description":965,"published":966,"category":525,"image":967,"draft":420},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":969,"title":970,"description":971,"published":972,"category":416,"image":973,"draft":420},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":975,"title":976,"description":977,"published":972,"category":525,"image":978,"draft":420},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":980,"title":981,"description":982,"published":983,"category":525,"image":984,"draft":420},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":986,"title":987,"description":988,"published":983,"category":416,"image":989,"draft":420},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]