[{"data":1,"prerenderedAt":908},["ShallowReactive",2],{"blog-en-supabase-free-plan-limits":3,"blog-index-en":561},{"id":4,"title":5,"body":6,"category":513,"cover":514,"coverAlt":515,"description":516,"draft":517,"extension":518,"faq":519,"image":537,"keywords":538,"meta":549,"navigation":550,"ogTitle":551,"path":552,"published":553,"seo":554,"stem":555,"tldr":556,"updated":553,"__hash__":560},"blog_en\u002Fblog\u002Fsupabase-free-plan-limits.md","Supabase free plan limits, and what happens at each one",{"type":7,"value":8,"toc":499},"minimark",[9,13,16,19,22,33,38,41,139,142,146,149,157,163,166,189,203,210,214,217,220,234,240,244,247,255,258,262,265,351,354,367,370,375,379,382,385,388,393,397,406,414,418,423,455,467,471,491],[10,11,12],"p",{},"Your app runs on a Supabase project, most likely one created on the free plan\nthe day Lovable or Bolt asked you to connect a database. It has worked for\nmonths. Then an email arrives saying your organization has gone over its usage\nquota, or a customer writes in to say the signup button does nothing, and you go\nlooking for what the free plan actually allows.",[10,14,15],{},"The Supabase free plan limits are easy to find. What happens when you cross each\none is much harder to find, and it is different for every line. One stops your\napp saving anything while its pages still load. One can switch off every project\nyou have. One trips when nobody has visited for a week.",[10,17,18],{},"Here is where the usual comparison goes wrong. They treat Pro as the free plan\nwith bigger numbers, and tell you to upgrade when one of the numbers runs out.\nFor an app with real users, the reason to pay usually arrives first, and it is\non no usage graph: the free plan keeps no copy of your database, and the $25\nthat stops the pausing is the same $25 that starts daily backups.",[10,20,21],{},"Think of the free plan as a fuse box. Every limit is a breaker, and the question\nworth asking about each one is which circuit it cuts when it trips.",[10,23,24,25,32],{},"Every figure below was read off Supabase's\n",[26,27,31],"a",{"href":28,"rel":29},"https:\u002F\u002Fsupabase.com\u002Fpricing",[30],"nofollow","pricing page"," and documentation on 29 September 2026. They are Supabase's numbers and they move, so read them again there on the\nday you decide.",[34,35,37],"h2",{"id":36},"what-are-the-supabase-free-plan-limits","What are the Supabase free plan limits?",[10,39,40],{},"Five usage limits, a rule about inactivity, a cap on projects, and one thing\nthat is missing altogether. This is the free plan as Supabase lists it, with\nwhat each line does when you cross it.",[42,43,44,60],"table",{},[45,46,47],"thead",{},[48,49,50,54,57],"tr",{},[51,52,53],"th",{},"Limit",[51,55,56],{},"Free plan",[51,58,59],{},"When you go past it",[61,62,63,75,86,96,106,117,128],"tbody",{},[48,64,65,69,72],{},[66,67,68],"td",{},"Database size",[66,70,71],{},"500 MB per project",[66,73,74],{},"That project turns read-only: pages load, nothing saves",[48,76,77,80,83],{},[66,78,79],{},"Egress",[66,81,82],{},"5 GB a month, plus 5 GB cached",[66,84,85],{},"A warning, a grace period, then restrictions",[48,87,88,91,94],{},[66,89,90],{},"File storage",[66,92,93],{},"1 GB",[66,95,85],{},[48,97,98,101,104],{},[66,99,100],{},"Monthly active users",[66,102,103],{},"50,000",[66,105,85],{},[48,107,108,111,114],{},[66,109,110],{},"Inactivity",[66,112,113],{},"7 days",[66,115,116],{},"The project is paused",[48,118,119,122,125],{},[66,120,121],{},"Active projects",[66,123,124],{},"2",[66,126,127],{},"You cannot start a third",[48,129,130,133,136],{},[66,131,132],{},"Automatic backups",[66,134,135],{},"None",[66,137,138],{},"No copy exists to restore from",[10,140,141],{},"The rows sit on two kinds of breaker. The database limit cuts one circuit on one\nproject, the moment it trips. Egress, storage and users sit on the main switch.\nSupabase calls it its Fair Use Policy, it covers every project in the\norganization, and it trips slowly, with an email to your billing address and a\ngrace period first.",[34,143,145],{"id":144},"what-happens-when-you-hit-the-500-mb-limit","What happens when you hit the 500 MB limit?",[10,147,148],{},"Your database goes into read-only mode. Visitors can still browse, because\nreading still works, and everything that saves something fails.",[10,150,151,152,156],{},"A signup is a write. So is a new order, an edited profile, a sent message and a\nsubmitted form. In read-only mode Postgres refuses every one of them, and your\napp's requests come back with the error\n",[153,154,155],"code",{},"cannot execute INSERT in a read-only transaction",". In an app made with an AI\nbuilder, the person clicking may see that as a spinner, or as nothing at all. The\npages that still load are what make it hard to spot. From outside the app looks\nfine, and it has stopped taking in anything new.",[158,159],"diagram",{"alt":160,"caption":161,"src":162},"A database filled to its limit line. Reads leave it on the right and arrive at a screen, ticked. New rows arriving on the left stop against a barrier at the database wall, each one crossed.","At 500 MB the database keeps answering and stops accepting. Everything a visitor saves is a write.","\u002Fblog\u002Fsupabase-free-plan-limits\u002Freads-out-writes-refused-1600x620.png",[10,164,165],{},"Three things about the 500 MB catch people out:",[167,168,169,177,183],"ul",{},[170,171,172,176],"li",{},[173,174,175],"strong",{},"It counts your data, not the disk."," Supabase measures your tables, indexes\nand materialized views. The free project sits on 1 GB of disk, and the space\nabove 500 MB is not yours to fill.",[170,178,179,182],{},[173,180,181],{},"Some of it is used before you start."," A new project is already around 40\nto 60 MB before your first row, which Supabase puts down to the extensions and\nschemas it installs.",[170,184,185,188],{},[173,186,187],{},"Deleting rows does not hand the space back at once."," Postgres marks deleted\nrows as removed and reclaims the room when a vacuum runs, so a cleanup can\nlook as if it did nothing.",[10,190,191,192,197,198,202],{},"There are two ways out. Upgrade to Pro, where each project gets 8 GB of disk and\ncan grow past it once the spend cap is off. Or make room: Supabase's\n",[26,193,196],{"href":194,"rel":195},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fplatform\u002Fdatabase-size",[30],"database size guide","\nshows how to switch read-only off for one session in the SQL Editor, delete what\nyou no longer need, run a vacuum and turn writes back on. Take a copy before you\ndelete anything, because on the free plan nobody else has one.\n",[26,199,201],{"href":200},"\u002Fblog\u002Fback-up-supabase-free-tier","Making one from the dashboard"," needs no\nterminal.",[10,204,205,206,209],{},"There is also a second, slower breaker on database size. Supabase watches the\norganization's database size averaged across the billing month, and an\norganization over that quota can be restricted, with every request answered\n",[153,207,208],{},"402",". Because it is an average, shrinking the database today does not lift it.\nThe next billing month does, and so does an upgrade.",[34,211,213],{"id":212},"what-counts-as-egress-on-the-supabase-free-plan","What counts as egress on the Supabase free plan?",[10,215,216],{},"Every byte your projects send out. The free plan's 5 GB a month is shared by the\nwhole organization, and it is a limit you can reach without doing anything\nunusual.",[10,218,219],{},"Supabase counts it across every service: the rows your app reads through its\nAPI, sign-ins, files your users download from Storage, Edge Function responses\nand Realtime updates. Files served from Supabase's cache count against a second\n5 GB of their own, and that one applies to Storage only.",[10,221,222,223,228,229,233],{},"Backups count too. Every copy taken from outside Supabase is a download,\nwhichever tool takes it, ours included, and Supabase's\n",[26,224,227],{"href":225,"rel":226},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fplatform\u002Fmanage-your-usage\u002Fegress",[30],"own advice on reducing egress","\nlists backing up fewer tables, or less often. A daily copy of a database at the\n500 MB limit moves about 15 GB a month. That is three times the free allowance\nbefore one visitor has loaded a page.\n",[26,230,232],{"href":231},"\u002Fblog\u002Fsupabase-backup-github-action","The egress a scheduled backup spends"," is\nlaid out there by database size, if you are choosing how often to take one.",[10,235,236,237,239],{},"Going over does not cut anything off that day. Supabase emails your billing\naddress and starts a grace period. Stay over, and the restrictions its billing\nFAQ lists are pausing projects, switching databases to read-only, and answering\nevery API request with a ",[153,238,208],{}," status code, and they generally apply to every\nproject in the organization. They lift when the next billing cycle begins, or at\nonce if you upgrade. The grace period is also a one-off. After it, a second overshoot is\nrestricted straight away, until you have stayed under the limits for several\nbilling cycles.",[34,241,243],{"id":242},"why-does-the-free-plan-pause-a-quiet-project","Why does the free plan pause a quiet project?",[10,245,246],{},"Because nobody used it. A free project with too little database activity over\nseven days is paused, which makes it the one breaker in the box that trips when\nnothing happens.",[10,248,249,250,254],{},"Supabase emails a warning about a week before and a confirmation when it\npauses. Your pages usually carry on loading, because your builder serves those,\nwhile everything behind them stops answering. A seasonal shop, an app between\nlaunches, a tool a client opens once a month: each looks inactive to this rule.\nYou have a year to press Resume, and\n",[26,251,253],{"href":252},"\u002Fblog\u002Fsupabase-project-paused-recover","what to do when a project is already paused","\nis its own article.",[10,256,257],{},"Projects on a paid plan are never paused for inactivity.",[34,259,261],{"id":260},"how-much-does-supabase-pro-cost-and-what-does-it-add","How much does Supabase Pro cost, and what does it add?",[10,263,264],{},"$25 a month for the organization, which includes $10 of compute credits covering\none project on Supabase's default Micro instance.",[42,266,267,279],{},[45,268,269],{},[48,270,271,273,276],{},[51,272],{},[51,274,275],{},"Free",[51,277,278],{},"Pro",[61,280,281,292,302,311,320,331,340],{},[48,282,283,286,289],{},[66,284,285],{},"Database",[66,287,288],{},"500 MB, then read-only",[66,290,291],{},"8 GB of disk, more with the spend cap off",[48,293,294,296,299],{},[66,295,79],{},[66,297,298],{},"5 GB a month",[66,300,301],{},"250 GB a month",[48,303,304,306,308],{},[66,305,90],{},[66,307,93],{},[66,309,310],{},"100 GB",[48,312,313,315,317],{},[66,314,100],{},[66,316,103],{},[66,318,319],{},"100,000",[48,321,322,325,328],{},[66,323,324],{},"Pausing",[66,326,327],{},"After a quiet week",[66,329,330],{},"Never",[48,332,333,335,337],{},[66,334,132],{},[66,336,135],{},[66,338,339],{},"Daily, kept for 7 days",[48,341,342,345,348],{},[66,343,344],{},"Support",[66,346,347],{},"Community",[66,349,350],{},"Email",[10,352,353],{},"For a small app with real users, two rows in that table are the ones that decide\nit. The pausing stops and the daily backups start, for the same $25. An app with\na few hundred users can sit far under every limit on the free plan and still lose a week of work to one bad\nmigration, with no copy to go back to.",[10,355,356,357,361,362,366],{},"The backups Pro turns on are kept inside your Supabase account, they cover the\ndatabase, and they reach back seven days.\n",[26,358,360],{"href":359},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database?","\ngoes through what that copy survives. To rewind to a particular minute rather\nthan to last night, Supabase sells point-in-time recovery as an add-on at $100 a\nmonth on top of Pro, and\n",[26,363,365],{"href":364},"\u002Fblog\u002Fsupabase-point-in-time-recovery","what that add-on buys"," has the detail.",[10,368,369],{},"Pro also changes what a limit does. It comes with a spend cap, switched on by\ndefault, and with the cap on Pro works like the free plan at a higher ceiling:\ngo past a quota and you get the same grace period and the same restrictions.\nSwitch the cap off and the breakers become meters. Nothing stops, and the\noverage is billed at the rates on Supabase's pricing page. Choose by which would\nhurt you more, a larger bill or an app that stops.",[158,371],{"alt":372,"caption":373,"src":374},"Two lines of flow crossing the same dashed limit. On the upper line a tripped switch stands at the limit and nothing passes it. On the lower line a meter stands at the limit, the flow continues through it, and coins stack up beside it.","With the spend cap on, crossing a quota stops things. With it off, crossing one adds to the bill.","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fbreaker-or-meter-1600x620.png",[34,376,378],{"id":377},"does-upgrading-one-supabase-project-upgrade-all-of-them","Does upgrading one Supabase project upgrade all of them?",[10,380,381],{},"Yes. The plan belongs to the organization, and every project in it moves\ntogether.",[10,383,384],{},"Supabase does not let you mix free and paid projects in one organization. If\nyour live app shares one with a test project you forgot about, upgrading puts\nboth on Pro, and the second adds about $10 a month of compute on top of the $25,\nbecause the included credits cover one project.",[10,386,387],{},"The fix costs nothing. Before you upgrade, move the project that should stay\nfree into an organization of its own. Supabase calls this a project transfer,\nand you start it from that project's general settings.",[158,389],{"alt":390,"caption":391,"src":392},"An organization outline holding two projects, both lit in the paid colour, with a coin above each. Beside it the same pair after a transfer: the live project alone in a lit organization with one coin, and the test project in a separate, unlit organization with none.","The plan is set on the organization. A project that should stay free needs an organization of its own.","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fone-organization-one-plan-1600x620.png",[34,394,396],{"id":395},"what-does-no-supabase-plan-copy-for-you","What does no Supabase plan copy for you?",[10,398,399,400,405],{},"The files your users uploaded, your Edge Functions, and your project's settings.\nEvery plan's backups are a copy of the database, and Supabase's\n",[26,401,404],{"href":402,"rel":403},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fplatform\u002Fbackups",[30],"backup documentation"," says\nplainly that they do not include objects stored through the Storage API.",[10,407,408,409,413],{},"When Supabase restores a backup into a new project, its list of what has to be\nset up again by hand includes Storage files and bucket settings, Edge Functions,\nAuth settings and API keys. That holds on the free plan, on Pro and on\neverything above it. The avatars and PDFs in your buckets need their own copy,\nand ",[26,410,412],{"href":411},"\u002Fblog\u002Fsupabase-storage-backup","how to back up Supabase Storage"," covers the\nways to take one.",[34,415,417],{"id":416},"where-reeve-care-fits","Where Reeve Care fits",[10,419,420],{},[173,421,422],{},"Care keeps a copy of your Supabase database outside your Supabase account, on\na schedule, whichever Supabase plan you are on.",[167,424,425,431,437,443,449],{},[170,426,427,430],{},[173,428,429],{},"Daily on Care, and more often on the plans above it."," A copy that fails\nsends you an email, which is how a paused project gets noticed the night it\nstops answering.",[170,432,433,436],{},[173,434,435],{},"The copy lives outside your Supabase account."," Encrypted, on storage we\nhold, so a pause, a restriction or a lost login leaves your backups where\nthey were.",[170,438,439,442],{},[173,440,441],{},"Every copy is read back before it counts."," The date on your dashboard is\nthe last copy that passed that check.",[170,444,445,448],{},[173,446,447],{},"Restoring is a button",", and it takes a snapshot of the current state\nfirst, so the restore has an undo of its own.",[170,450,451,454],{},[173,452,453],{},"The files your users uploaded come too",", once you connect a Storage\ncredential. That is a second key, asked for separately, because the key\nSupabase issues for Storage can write as well as read.",[10,456,457,458,461,462,466],{},"Care starts at $49 a month for one app. That is a list price, and the\n",[26,459,31],{"href":460},"\u002Fpricing"," is sometimes below it and never above. On Pro, keep\nSupabase's own daily backups switched on as well, so there are two copies in two\nplaces. The copy, the check and the restore are drawn step by step on the\n",[26,463,465],{"href":464},"\u002Fsupabase-backups","Supabase backups page",".",[34,468,470],{"id":469},"what-to-do-this-week","What to do this week",[472,473,474],"key-takeaways",{},[167,475,476,479,482,485,488],{},[170,477,478],{},"Open your organization's Usage page in the Supabase dashboard and read three numbers: database size, last month's egress and file storage. Each one is a row in the first table above.",[170,480,481],{},"If the database is getting close to 500 MB, choose between upgrading and cleaning up now, before read-only mode chooses for you.",[170,483,484],{},"Before you upgrade, check which projects share the organization, and move any that should stay free into an organization of their own.",[170,486,487],{},"If you stay on the free plan, keep your own copy of the database somewhere outside Supabase, as Supabase's own documentation recommends.",[170,489,490],{},"If you move to Pro, look under Database, then Backups, the next day and confirm the first daily copy is there.",[10,492,493,494,498],{},"Before you close this tab, open the Usage page and find the number sitting\nclosest to its limit. That is the breaker nearest to tripping. The\n",[26,495,497],{"href":496},"\u002Fchecklist","10-minute security checklist"," covers backups alongside the rest of\nwhat is worth confirming on an app people rely on.",{"title":500,"searchDepth":501,"depth":501,"links":502},"",3,[503,505,506,507,508,509,510,511,512],{"id":36,"depth":504,"text":37},2,{"id":144,"depth":504,"text":145},{"id":212,"depth":504,"text":213},{"id":242,"depth":504,"text":243},{"id":260,"depth":504,"text":261},{"id":377,"depth":504,"text":378},{"id":395,"depth":504,"text":396},{"id":416,"depth":504,"text":417},{"id":469,"depth":504,"text":470},"Security basics","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcover-1200x630.png","A panel of circuit breakers with every switch up except one, which has tripped and sits in an amber band.","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.",false,"md",[520,523,525,528,531,534],{"q":521,"a":522},"How much does Supabase cost?","The free plan costs nothing. Pro starts at $25 a month for the organization, and that includes $10 of compute credits, enough for one project on the default Micro instance. Each further project on a paid plan adds about $10 a month of compute. Team and Enterprise sit above Pro for companies that need things like single sign-on and compliance reports. Read the figures off Supabase's pricing page on the day you decide, because they are theirs to change.",{"q":37,"a":524},"On 29 September 2026 Supabase listed 500 MB of database per project, 1 GB of file storage, 5 GB of egress a month plus 5 GB of cached egress, 50,000 monthly active users and two active projects. A project with too little activity over a week is paused, and the free plan takes no automatic backups at all.",{"q":526,"a":527},"What happens when I hit the 500 MB limit?","The project goes into read-only mode. Pages that only read data keep working, and everything that writes fails with the error cannot execute INSERT in a read-only transaction: signups, orders, saved forms. Either upgrade to Pro, or switch read-only off for one session in the SQL Editor, delete what you do not need and run a vacuum so the space is actually given back. Take a copy before you delete anything.",{"q":529,"a":530},"Does the Supabase free plan include backups?","No. Supabase lists automatic backups as not included on the free plan, and its documentation recommends that free projects export their data regularly with the Supabase CLI and keep that copy somewhere else. Daily backups start on Pro, which keeps the last seven.",{"q":532,"a":533},"Is Supabase Pro worth it for a small app?","If real people depend on it, usually yes, and rarely because of the space. Pro stops the weekly pause and turns on daily backups. An app with a few hundred users can sit far below every free limit and still lose a week of work to one bad migration, and on the free plan there is no copy to go back to.",{"q":535,"a":536},"Do backups count against my Supabase egress?","Yes, when the copy is taken from outside Supabase. Egress is every byte your projects send out, and a backup is a download. Supabase's own advice on reducing egress includes backing up fewer tables or less often. A daily copy of a database at the 500 MB limit moves about 15 GB a month, three times the free allowance, and your app's own traffic draws on the same 5 GB.","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",[539,540,541,542,543,544,545,546,547,548],"supabase free plan limits","supabase pricing","how much does supabase cost","supabase free tier limits","supabase 500mb limit","supabase egress limit","supabase pro plan price","supabase read only mode","supabase storage limit","when to upgrade supabase",{},true,"Supabase free plan limits, and what happens at each","\u002Fblog\u002Fsupabase-free-plan-limits","2026-09-29",{"title":5,"description":516},"blog\u002Fsupabase-free-plan-limits",[557,558,559],"The Supabase free plan limits are 500 MB of database, 1 GB of files, 5 GB of egress a month and 50,000 monthly active users, and it keeps no automatic backup of your database.","Each limit stops something different. At 500 MB your database turns read-only and signups fail. Over the egress allowance, after a grace period, every project in your organization can be restricted.","Pro costs $25 a month. The payment that stops the weekly pause also turns on daily backups, and for an app with real users that is usually the reason to move.","Jisrog1p7q68IWlKWKNg3WwATJk4TpxAFzCHxwHx1Zk",[562,568,574,580,586,592,598,604,610,616,622,628,629,636,641,647,652,658,664,670,676,682,688,694,700,706,712,718,723,728,733,739,745,751,757,763,769,775,781,787,793,799,805,810,816,822,828,834,840,846,852,858,864,870,875,881,886,892,897,903],{"path":563,"title":564,"description":565,"published":566,"category":513,"image":567,"draft":517},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":569,"title":570,"description":571,"published":572,"category":513,"image":573,"draft":517},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":575,"title":576,"description":577,"published":578,"category":513,"image":579,"draft":517},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":581,"title":582,"description":583,"published":584,"category":513,"image":585,"draft":517},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":587,"title":588,"description":589,"published":590,"category":513,"image":591,"draft":517},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":593,"title":594,"description":595,"published":596,"category":513,"image":597,"draft":517},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":599,"title":600,"description":601,"published":602,"category":513,"image":603,"draft":517},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":605,"title":606,"description":607,"published":608,"category":513,"image":609,"draft":517},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":611,"title":612,"description":613,"published":614,"category":513,"image":615,"draft":517},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":617,"title":618,"description":619,"published":620,"category":513,"image":621,"draft":517},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":623,"title":624,"description":625,"published":626,"category":513,"image":627,"draft":517},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":552,"title":5,"description":516,"published":553,"category":513,"image":537,"draft":517},{"path":630,"title":631,"description":632,"published":633,"category":634,"image":635,"draft":517},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","Backups","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":231,"title":637,"description":638,"published":639,"category":634,"image":640,"draft":517},"Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":642,"title":643,"description":644,"published":645,"category":634,"image":646,"draft":517},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":648,"title":649,"description":650,"published":645,"category":513,"image":651,"draft":517},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":653,"title":654,"description":655,"published":656,"category":513,"image":657,"draft":517},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":659,"title":660,"description":661,"published":662,"category":513,"image":663,"draft":517},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":665,"title":666,"description":667,"published":668,"category":634,"image":669,"draft":517},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":671,"title":672,"description":673,"published":674,"category":513,"image":675,"draft":517},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":677,"title":678,"description":679,"published":680,"category":513,"image":681,"draft":517},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":683,"title":684,"description":685,"published":686,"category":513,"image":687,"draft":517},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":689,"title":690,"description":691,"published":692,"category":513,"image":693,"draft":517},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":695,"title":696,"description":697,"published":698,"category":513,"image":699,"draft":517},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":701,"title":702,"description":703,"published":704,"category":513,"image":705,"draft":517},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":707,"title":708,"description":709,"published":710,"category":513,"image":711,"draft":517},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":713,"title":714,"description":715,"published":716,"category":513,"image":717,"draft":517},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":411,"title":719,"description":720,"published":721,"category":634,"image":722,"draft":517},"Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":364,"title":724,"description":725,"published":726,"category":634,"image":727,"draft":517},"Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":252,"title":729,"description":730,"published":731,"category":634,"image":732,"draft":517},"Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":734,"title":735,"description":736,"published":737,"category":513,"image":738,"draft":517},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":740,"title":741,"description":742,"published":743,"category":513,"image":744,"draft":517},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":746,"title":747,"description":748,"published":749,"category":513,"image":750,"draft":517},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":752,"title":753,"description":754,"published":755,"category":513,"image":756,"draft":517},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":758,"title":759,"description":760,"published":761,"category":513,"image":762,"draft":517},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Ten tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":764,"title":765,"description":766,"published":767,"category":513,"image":768,"draft":517},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":770,"title":771,"description":772,"published":773,"category":513,"image":774,"draft":517},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":776,"title":777,"description":778,"published":779,"category":513,"image":780,"draft":517},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":782,"title":783,"description":784,"published":785,"category":513,"image":786,"draft":517},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":788,"title":789,"description":790,"published":791,"category":513,"image":792,"draft":517},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":794,"title":795,"description":796,"published":797,"category":634,"image":798,"draft":517},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":800,"title":801,"description":802,"published":803,"category":513,"image":804,"draft":517},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":200,"title":806,"description":807,"published":808,"category":634,"image":809,"draft":517},"Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":811,"title":812,"description":813,"published":814,"category":513,"image":815,"draft":517},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":817,"title":818,"description":819,"published":820,"category":513,"image":821,"draft":517},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":823,"title":824,"description":825,"published":826,"category":513,"image":827,"draft":517},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":829,"title":830,"description":831,"published":832,"category":513,"image":833,"draft":517},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":835,"title":836,"description":837,"published":838,"category":634,"image":839,"draft":517},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":841,"title":842,"description":843,"published":844,"category":634,"image":845,"draft":517},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":847,"title":848,"description":849,"published":850,"category":513,"image":851,"draft":517},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":853,"title":854,"description":855,"published":856,"category":513,"image":857,"draft":517},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":859,"title":860,"description":861,"published":862,"category":634,"image":863,"draft":517},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":865,"title":866,"description":867,"published":868,"category":513,"image":869,"draft":517},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":871,"title":872,"description":873,"published":868,"category":513,"image":874,"draft":517},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":876,"title":877,"description":878,"published":879,"category":513,"image":880,"draft":517},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase's new API keys: which one is safe in your app?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":359,"title":882,"description":883,"published":884,"category":634,"image":885,"draft":517},"Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":887,"title":888,"description":889,"published":890,"category":513,"image":891,"draft":517},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":893,"title":894,"description":895,"published":890,"category":634,"image":896,"draft":517},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":898,"title":899,"description":900,"published":901,"category":634,"image":902,"draft":517},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":904,"title":905,"description":906,"published":901,"category":513,"image":907,"draft":517},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1791618966336]