[{"data":1,"prerenderedAt":1130},["ShallowReactive",2],{"blog-en-supabase-invalid-jwt":3,"blog-index-en":604},{"id":4,"title":5,"body":6,"category":562,"cover":563,"coverAlt":564,"description":565,"draft":566,"extension":567,"faq":568,"image":584,"keywords":585,"meta":593,"navigation":594,"ogTitle":5,"path":595,"published":596,"seo":597,"stem":598,"tldr":599,"updated":596,"__hash__":603},"blog_en\u002Fblog\u002Fsupabase-invalid-jwt.md","Supabase invalid JWT: which key stopped working?",{"type":7,"value":8,"toc":549},"minimark",[9,13,24,27,39,44,47,50,53,56,62,66,73,87,167,172,179,200,207,211,221,233,236,262,267,270,282,293,297,300,312,328,332,335,367,371,374,396,399,406,410,413,430,433,441,444,448,454,463,477,487,504,508,537],[10,11,12],"p",{},"Your app worked yesterday. This morning every request comes back 401, nothing in\nyour code has changed, and the reply is talking about a JWT, which is not a thing\nyou have ever typed into anything.",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","{\n  \"code\": \"PGRST301\",\n  \"message\": \"JWT cryptographic operation failed\"\n}\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26],{},"A Supabase invalid JWT error is the one that turns up after you have done the\nright thing. You rotated a key because a guide told you to, or you switched your\nproject onto the newer keys, and the app went quiet.",[10,28,29,30,34,35,38],{},"Here is the part that guide after guide gets wrong: ",[31,32,33],"strong",{},"the key in this message is\noften not the key you just changed."," Search the error and you will be told to go\nand check your ",[21,36,37],{},"anon"," key. On a project that has moved to publishable and secret\nkeys, the API key is not a signed token at all, so whatever failed verification\nwas something else in the request.",[40,41,43],"h2",{"id":42},"what-does-a-supabase-invalid-jwt-error-mean","What does a Supabase invalid JWT error mean?",[10,45,46],{},"Something in your request was a signed token, and the signature did not check\nout.",[10,48,49],{},"A password is a word somebody looks up on a list. A JWT is not that. It is a\nletter closed with a wax seal: the person at the door does not look you up\nanywhere, they hold a signet and check whether the seal on your letter was made\nby it. If it was, you go through, and nobody reads a list.",[10,51,52],{},"A letter sealed with the wrong signet is refused even though every word inside it\nis correct. And the moment the door changes its signet, every letter already out\nin the world stops opening, without anybody touching the letters.",[10,54,55],{},"Your request is the letter. Your Supabase project holds the signet. A 401 here\nmeans the two did not agree.",[57,58],"diagram",{"alt":59,"caption":60,"src":61},"Two lanes carrying a sealed letter to the same signet, which is engraved with a three-spoke mark. In the upper lane the letter's seal carries the same mark, the letter goes through, the table beyond holds three lit rows and the reply is 200. In the lower lane the letter's seal carries a boxed dot instead, an amber bar stops it, the table beyond is an empty dashed outline and the reply is 401.","Nothing is looked up. The seal on the token is compared with the signet your project holds, and a letter whose seal was made by something else is refused whatever is written inside it.","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fhow-the-check-works-1600x660.png",[40,63,65],{"id":64},"the-message-changed-in-postgrest-13-and-the-code-did-not","The message changed in PostgREST 13, and the code did not",[10,67,68,69,72],{},"Match on ",[21,70,71],{},"PGRST301",". The sentence beside it depends on which version of PostgREST\nyour project runs, and the newer versions give you a short list of them.",[10,74,75,76,78,79,82,83,86],{},"PostgREST's own error reference describes ",[21,77,71],{}," as a provided JWT that could\nnot be decoded or is invalid, at HTTP 401, in both version 13 and version 14.\nThat sentence is the description in the documentation table. It is not what lands\nin your ",[21,80,81],{},"message"," field. Reading PostgREST's ",[21,84,85],{},"Error.hs"," on the main branch, the\nfield carries one of these:",[88,89,90,103],"table",{},[91,92,93],"thead",{},[94,95,96,100],"tr",{},[97,98,99],"th",{},"What the message says",[97,101,102],{},"What it tells you",[104,105,106,117,127,137,147,157],"tbody",{},[94,107,108,114],{},[109,110,111],"td",{},[21,112,113],{},"Empty JWT is sent in Authorization header",[109,115,116],{},"The header was sent and there was nothing in it.",[94,118,119,124],{},[109,120,121],{},[21,122,123],{},"Expected 3 parts in JWT; got 1",[109,125,126],{},"Whatever was sent is not a JWT. A JWT is three chunks separated by dots.",[94,128,129,134],{},[109,130,131],{},[21,132,133],{},"No suitable key or wrong key type",[109,135,136],{},"The server has no key able to verify a token of this kind.",[94,138,139,144],{},[109,140,141],{},[21,142,143],{},"Wrong or unsupported encoding algorithm",[109,145,146],{},"The token names a signing algorithm the server will not use.",[94,148,149,154],{},[109,150,151],{},[21,152,153],{},"JWT cryptographic operation failed",[109,155,156],{},"The token is well formed and the signature does not match.",[94,158,159,164],{},[109,160,161],{},[21,162,163],{},"Unsupported token type",[109,165,166],{},"The token is of a shape PostgREST does not read.",[10,168,169,171],{},[21,170,153],{}," is the one that means a stale key. The\ntoken was built correctly and signed by something the project no longer holds,\nwhich is precisely what a rotation leaves behind.",[10,173,174,175,178],{},"Older projects see something very different, and this is why one particular\nstring is all over the search results. Before version 13, PostgREST printed\nwhatever its JWT library had said, exactly as the library said it. That is where\n",[21,176,177],{},"JWSError JWSInvalidSignature"," comes from: it is a library value printed to the\nscreen, not a sentence anybody wrote for you. PostgREST's changelog for 13.0.0\ndescribes the change as diagnostic error messages instead of exposed internals.",[180,181,183],"callout",{"type":182},"warn",[10,184,185,188,189,192,193,195,196,199],{},[31,186,187],{},"If your own code matches on the message text, match on the code instead."," A\ncheck comparing ",[21,190,191],{},"error.message"," against ",[21,194,177],{}," works\ntoday and stops working the day your project moves to a newer PostgREST, with no\ndeploy of yours in between. Supabase says the same thing in its own error\ndocumentation: use ",[21,197,198],{},"error.code",", not string matching on error messages.",[10,201,202,203,206],{},"One neighbouring code is worth knowing while you are here. ",[21,204,205],{},"PGRST303",", also 401,\nis what you get when the signature verified and the contents of the token were\nrefused: expired, not valid yet, or carrying the wrong audience. If that is the\ncode you have, stop looking at your keys and go and look at the clock and the\nsession.",[40,208,210],{"id":209},"which-key-is-it-your-api-key-or-your-users-token","Which key is it: your API key or your user's token?",[10,212,213,214,216,217,220],{},"It depends on whether your project still uses ",[21,215,37],{}," and ",[21,218,219],{},"service_role",".",[10,222,223,224,216,226,228,229,232],{},"Supabase's API keys documentation is explicit about the difference. The legacy\n",[21,225,37],{},[21,227,219],{}," keys are long-lived JWTs, which is why they begin\n",[21,230,231],{},"eyJ",". The newer publishable and secret keys are short strings and are not JWTs\nat all.",[10,234,235],{},"That one fact splits this error in two:",[237,238,239,250],"ul",{},[240,241,242,249],"li",{},[31,243,244,245,216,247,220],{},"Your project still uses ",[21,246,37],{},[21,248,219],{}," The API key in your\nrequest is itself a signed token, so a key from another project, a key from\nbefore a rotation, or a truncated paste all fail the signature check in exactly\nthe way a bad session would. Either of the two tokens in the request can be the\none that failed.",[240,251,252,261],{},[31,253,254,255,216,258,220],{},"Your project has moved to ",[21,256,257],{},"sb_publishable_",[21,259,260],{},"sb_secret_"," The API key\nhas stopped being a token, so there is no signature on it for anything to\nreject. What is left to verify is your signed-in user's access token, which\nSupabase Auth issues separately from the API key.",[57,263],{"alt":264,"caption":265,"src":266},"Two rows, each ending at a signet. In the upper row, a sealed letter labelled anon and a second sealed letter beside a person both run to the signet. In the lower row, a plain card labelled sb_publishable_ carries no seal and no line, and only the sealed letter beside the person runs to the signet.","On a legacy project two sealed letters arrive and either can be the one refused. Move to the newer keys and the API key stops carrying a seal, so your signed-in user's session is the only thing left with a signature on it.","\u002Fblog\u002Fsupabase-invalid-jwt\u002Ftwo-things-called-your-key-1600x820.png",[10,268,269],{},"The practical result is that the first question to ask is not which key is wrong.\nIt is whether anybody was signed in when the request failed. If a signed-out page\nworks and a signed-in page does not, you are looking at sessions. If everything\nfails, including a page that asks for nothing personal, you are looking at the\nAPI key, and your project is a legacy one.",[10,271,272,273,276,277,220],{},"If it is sessions, and your auth log also says ",[21,274,275],{},"Invalid Refresh Token",", your\nusers are being signed out because\n",[278,279,281],"a",{"href":280},"\u002Fblog\u002Fsupabase-users-logged-out","the session behind their token ended",[10,283,284,285,288,289,220],{},"If the reply came from Supabase Auth and reads ",[21,286,287],{},"invalid claim: missing sub claim",", the token passed its signature check and named nobody. That is a key\nsent where a person's token belongs, and\n",[278,290,292],{"href":291},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","that message has a post of its own",[40,294,296],{"id":295},"invalid-jwt-is-not-no-api-key-found-in-request","Invalid JWT is not \"No API key found in request\"",[10,298,299],{},"These are two different messages with two different causes, and the fixes have\nnothing in common.",[10,301,302,303,307,308,311],{},"An invalid JWT means a token arrived and the signature did not match. ",[278,304,306],{"href":305},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API\nkey found in request\""," means no ",[21,309,310],{},"apikey","\nheader arrived at all, so the request was turned away at the gateway before your\ndatabase was asked for anything.",[10,313,314,315,317,318,321,322,324,325,327],{},"The reply itself settles which you have. A missing key is refused by the gateway\nin front of your project, so the body carries a ",[21,316,81],{}," and a ",[21,319,320],{},"hint"," and no\n",[21,323,21],{}," at all. An invalid JWT got far enough in to be read by PostgREST, which is\nwhy it comes back with ",[21,326,71],{}," written on it.",[40,329,331],{"id":330},"where-the-old-key-is-still-sitting-in-order","Where the old key is still sitting, in order",[10,333,334],{},"Four places, and they are worth checking in this order because that is roughly\nhow often each one is the answer.",[336,337,338,344,355,361],"ol",{},[240,339,340,343],{},[31,341,342],{},"Your builder's project settings."," Lovable, Bolt, v0 and Replit each keep\ntheir own set of environment variables, and if you built with Cursor or\nClaude Code the same set lives wherever you deploy. This is the copy most\npeople update, and the only copy most people update.",[240,345,346,349,350,354],{},[31,347,348],{},"A key written straight into the code."," It ships inside the JavaScript your\nvisitors download, so changing it in the dashboard changes nothing until the\nfile is edited and the site is rebuilt. ",[278,351,353],{"href":352},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where that page is, and what each\nvalue on it does",", if you have not\nopened it.",[240,356,357,360],{},[31,358,359],{},"Edge Function secrets."," A function keeps its own set, separate from your\nfrontend's, so it goes on using the old key after everything else has moved.\nSupabase also warns that a function with its Verify JWT setting on can break\nwhen you rotate a signing key.",[240,362,363,366],{},[31,364,365],{},"A deployment that nobody rebuilt."," The key was baked in when the site was\nlast built, so the running copy keeps sending it until something triggers a\nnew build. Your dashboard will show the new key throughout, which is what\nmakes this one hard to see: the place you go to check is the one place that\nis already correct.",[40,368,370],{"id":369},"which-key-your-live-app-is-actually-shipping","Which key your live app is actually shipping",[10,372,373],{},"Open the published site rather than the preview, and read what the page sends.",[10,375,376,377,379,380,382,383,385,386,390,391,395],{},"A legacy Supabase key is a long string beginning ",[21,378,231],{},". The newer ones announce\nthemselves in their first few characters: ",[21,381,257],{}," belongs in your app,\nand ",[21,384,260],{}," never does. If you find the second one in a page a visitor can\nload, stop reading this article and\n",[278,387,389],{"href":388},"\u002Fblog\u002Frotate-supabase-service-role-key","rotate it"," before you do anything else.\nWhich of the two you are holding, and\n",[278,392,394],{"href":393},"\u002Fblog\u002Fsupabase-new-api-keys","what changed when Supabase renamed them",", is the\nthing to settle before you start swapping values.",[10,397,398],{},"To see what your project currently issues, every key now lives in one place in\nthe dashboard, under Settings and then API Keys, legacy keys included.",[10,400,401,402,220],{},"If you would rather not read a minified bundle, our free scan reads your live app\nthe way a stranger would and reports the keys it can see from outside. It takes\nabout 20 seconds and needs no account: ",[278,403,405],{"href":404},"\u002Fsecurity-scanner","scan your app",[40,407,409],{"id":408},"rotating-a-signing-key-without-signing-everybody-out","Rotating a signing key without signing everybody out",[10,411,412],{},"Which of the two rotation paths you are on decides whether your users notice.",[10,414,415,416,419,420,422,423,425,426,429],{},"Supabase's signing-keys documentation sets them side by side. Rotating the\n",[31,417,418],{},"legacy JWT secret"," signs currently active users out immediately, and ",[21,421,37],{},"\nand ",[21,424,219],{}," have to be rotated at the same time. The newer ",[31,427,428],{},"JWT signing\nkeys"," work differently: a new key starts as a standby, rotating makes it the\ncurrent one, and the key it replaced becomes previously used. Signatures from\nboth keys go on being accepted while that is true, so letters sealed last week\nstill open. Revoking the old key is the separate step that stops accepting them.",[10,431,432],{},"Two warnings in that same documentation are the ones that catch people:",[237,434,435,438],{},[240,436,437],{},"A component that verifies tokens itself against the legacy JWT secret, with a\nlibrary such as jose or jsonwebtoken, breaks on the rotation. It is holding the\nold signet and nothing told it to change.",[240,439,440],{},"An Edge Function with Verify JWT switched on can break for the same reason.",[10,442,443],{},"Creating publishable and secret keys does not revoke your legacy keys either.\nThey keep working until you disable them, which the documentation calls out as a\nseparate step. So an app that moved half its copies over goes on working for\nweeks, and the day somebody disables the old pair is the day the remaining half\nstarts answering 401.",[40,445,447],{"id":446},"watching-an-app-that-has-started-answering-401","Watching an app that has started answering 401",[10,449,450,453],{},[31,451,452],{},"An app that returns 401 to every request is still up, still serving a page, and\nstill answering a health check."," Nothing in your dashboard turns red. You find\nout when somebody writes to you.",[10,455,456],{},[31,457,458,462],{},[278,459,461],{"href":460},"\u002Fwebsite-monitoring","Reeve Monitor"," finds out first:",[237,464,465,468,471,474],{},[240,466,467],{},"all nine checks every hour, on up to three apps",[240,469,470],{},"an email the day a re-scan grades your app lower than the one before",[240,472,473],{},"whether the app is up, every 60 seconds",[240,475,476],{},"a monthly report of what it saw",[10,478,479],{},[31,480,481,482,486],{},"A key you had to rotate in a hurry is usually a key that was somewhere it\nshould not have been, and from here you cannot see what was read or changed with\nit while it was out. ",[278,483,485],{"href":484},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your\nSupabase database from before that happened.",[237,488,489,492,495,498,501],{},[240,490,491],{},"an encrypted copy on a schedule, kept on Reeve's own storage in the EU, outside your Supabase account",[240,493,494],{},"each copy verified before it counts, by counting the rows in every table",[240,496,497],{},"a one-click restore that saves what is there now before it replaces anything",[240,499,500],{},"your uploaded files as well, once you connect a Storage credential",[240,502,503],{},"everything Monitor does",[40,505,507],{"id":506},"what-to-do-today","What to do today",[509,510,511],"key-takeaways",{},[237,512,513,525,528,531,534],{},[240,514,515,516,518,519,521,522,524],{},"Read the ",[21,517,21],{}," field, not the sentence. ",[21,520,71],{}," is a signature that did not match; ",[21,523,205],{}," is a token whose contents were refused, such as an expired one.",[240,526,527],{},"Work out which token failed before you change a key. If signed-out pages work and signed-in pages do not, it is a session rather than your API key.",[240,529,530],{},"Check all four places the old key hides: builder settings, the code itself, Edge Function secrets, and a deployment nobody rebuilt.",[240,532,533],{},"Do a rotation in one sitting. Every copy you leave behind is an app that half works, and the running site keeps sending the old key until it is rebuilt.",[240,535,536],{},"On the newer signing keys, revoking is the step that actually stops the old signatures. Rotating alone leaves them accepted.",[10,538,539,540,543,544,548],{},"Start by asking whether a signed-out page still loads, because that one answer\ndecides which half of this article applies to you. If it turns out a secret key\nwas out in the open, ",[278,541,542],{"href":388},"rotating it"," covers\nthe order to work in, and\n",[278,545,547],{"href":546},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","which keys were ever safe to ship","\ncovers how the pair came to look so alike in the first place.",{"title":23,"searchDepth":550,"depth":550,"links":551},3,[552,554,555,556,557,558,559,560,561],{"id":42,"depth":553,"text":43},2,{"id":64,"depth":553,"text":65},{"id":209,"depth":553,"text":210},{"id":295,"depth":553,"text":296},{"id":330,"depth":553,"text":331},{"id":369,"depth":553,"text":370},{"id":408,"depth":553,"text":409},{"id":446,"depth":553,"text":447},{"id":506,"depth":553,"text":507},"Security basics","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcover-1200x630.png","A sealed letter in front of a signet block whose face no longer matches the seal, with a rack of further letters behind an amber bar.","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.",false,"md",[569,572,575,578,581],{"q":570,"a":571},"What does PGRST301 mean?","PGRST301 is PostgREST answering HTTP 401 because a signed token in your request could not be verified. PostgREST is the server that turns your Supabase tables into the HTTP API your app talks to. Its own error reference describes the code as a provided JWT that could not be decoded or is invalid, and from version 13 onward the message field carries a more specific sentence saying which part of the check failed.",{"q":573,"a":574},"Why do I get 401 after rotating my Supabase key?","Because a copy of the old key is still being sent. The usual places are your builder project settings, a key typed straight into the code, an Edge Function secret, and a deployment that was built before you made the change and has not been rebuilt since. A token signed by a key the server no longer accepts fails verification, which reads as a 401 on every request rather than as a message about the key.",{"q":576,"a":577},"What is the difference between an invalid JWT and a missing API key?","They are different messages with different causes. \"No API key found in request\" means the request arrived with no apikey header at all and was turned away before your database was asked anything. An invalid JWT means a token was present and its signature did not check out. The first is a request that was not addressed; the second is a request that was addressed and sealed wrongly.",{"q":579,"a":580},"Do I have to update my Edge Functions too?","Yes, and they are the copy people forget, because an Edge Function keeps its own secrets, separate from the ones your frontend uses. Supabase also warns that a function with its Verify JWT setting switched on can break when you rotate a signing key, and that any component verifying tokens itself against the legacy JWT secret will break for the same reason.",{"q":582,"a":583},"How do I see which key my live app is using?","Open your published site, not your preview, and look at what the page actually sends. A legacy Supabase key is a long string beginning eyJ, and the newer ones begin sb_publishable_ or sb_secret_. Our free scan reads a live app the way a stranger would and reports the keys it can see from outside, which also tells you whether an old one is still being shipped.","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",[586,587,588,589,590,591,592],"supabase invalid jwt","pgrst301","bad_jwt supabase","supabase 401 after rotating key","jwsinvalidsignature supabase","supabase legacy key stopped working","provided jwt could not be decoded",{},true,"\u002Fblog\u002Fsupabase-invalid-jwt","2026-10-16",{"title":5,"description":565},"blog\u002Fsupabase-invalid-jwt",[600,601,602],"A Supabase invalid JWT error arrives as PGRST301 with HTTP 401, and it means the token your request carried failed its signature check. Nothing was looked up and refused.","Publishable and secret keys are short strings with no signature on them, so on a project that has moved to them this error is about your signed-in user and never about the API key.","PostgREST 13 replaced one vague sentence with a short list of specific ones. Read the message you actually got, because each of them rules out something different.","_Zhmk8zvd7gVYFSwoRs2yBejCzF9luIPFejSFJyfKr4",[605,611,617,623,629,635,640,646,652,658,664,671,677,683,689,695,701,707,713,719,725,731,736,742,748,749,755,761,767,773,779,785,791,797,802,808,814,820,826,832,838,844,850,856,862,868,873,879,885,891,897,903,909,915,921,927,933,939,945,951,957,963,969,975,980,986,992,998,1004,1010,1016,1022,1028,1034,1040,1045,1051,1057,1063,1069,1075,1081,1087,1093,1098,1103,1109,1115,1120,1126],{"path":606,"title":607,"description":608,"published":609,"category":562,"image":610,"draft":566},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":612,"title":613,"description":614,"published":615,"category":562,"image":616,"draft":566},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":618,"title":619,"description":620,"published":621,"category":562,"image":622,"draft":566},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":624,"title":625,"description":626,"published":627,"category":562,"image":628,"draft":566},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":630,"title":631,"description":632,"published":633,"category":562,"image":634,"draft":566},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":291,"title":636,"description":637,"published":638,"category":562,"image":639,"draft":566},"Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":641,"title":642,"description":643,"published":644,"category":562,"image":645,"draft":566},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":647,"title":648,"description":649,"published":650,"category":562,"image":651,"draft":566},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":653,"title":654,"description":655,"published":656,"category":562,"image":657,"draft":566},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":659,"title":660,"description":661,"published":662,"category":562,"image":663,"draft":566},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":665,"title":666,"description":667,"published":668,"category":669,"image":670,"draft":566},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":672,"title":673,"description":674,"published":675,"category":562,"image":676,"draft":566},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":678,"title":679,"description":680,"published":681,"category":562,"image":682,"draft":566},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":684,"title":685,"description":686,"published":687,"category":562,"image":688,"draft":566},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":690,"title":691,"description":692,"published":693,"category":562,"image":694,"draft":566},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":696,"title":697,"description":698,"published":699,"category":562,"image":700,"draft":566},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":702,"title":703,"description":704,"published":705,"category":562,"image":706,"draft":566},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":708,"title":709,"description":710,"published":711,"category":562,"image":712,"draft":566},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":714,"title":715,"description":716,"published":717,"category":562,"image":718,"draft":566},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":720,"title":721,"description":722,"published":723,"category":562,"image":724,"draft":566},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":726,"title":727,"description":728,"published":729,"category":562,"image":730,"draft":566},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":280,"title":732,"description":733,"published":734,"category":562,"image":735,"draft":566},"Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":737,"title":738,"description":739,"published":740,"category":562,"image":741,"draft":566},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":743,"title":744,"description":745,"published":746,"category":562,"image":747,"draft":566},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":595,"title":5,"description":565,"published":596,"category":562,"image":584,"draft":566},{"path":750,"title":751,"description":752,"published":753,"category":562,"image":754,"draft":566},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":756,"title":757,"description":758,"published":759,"category":562,"image":760,"draft":566},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":762,"title":763,"description":764,"published":765,"category":562,"image":766,"draft":566},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":768,"title":769,"description":770,"published":771,"category":562,"image":772,"draft":566},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":774,"title":775,"description":776,"published":777,"category":562,"image":778,"draft":566},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":780,"title":781,"description":782,"published":783,"category":562,"image":784,"draft":566},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":786,"title":787,"description":788,"published":789,"category":562,"image":790,"draft":566},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":792,"title":793,"description":794,"published":795,"category":562,"image":796,"draft":566},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":305,"title":798,"description":799,"published":800,"category":562,"image":801,"draft":566},"\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":803,"title":804,"description":805,"published":806,"category":562,"image":807,"draft":566},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":809,"title":810,"description":811,"published":812,"category":562,"image":813,"draft":566},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":815,"title":816,"description":817,"published":818,"category":562,"image":819,"draft":566},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":821,"title":822,"description":823,"published":824,"category":562,"image":825,"draft":566},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":827,"title":828,"description":829,"published":830,"category":562,"image":831,"draft":566},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":833,"title":834,"description":835,"published":836,"category":562,"image":837,"draft":566},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":839,"title":840,"description":841,"published":842,"category":562,"image":843,"draft":566},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":845,"title":846,"description":847,"published":848,"category":562,"image":849,"draft":566},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":851,"title":852,"description":853,"published":854,"category":669,"image":855,"draft":566},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":857,"title":858,"description":859,"published":860,"category":669,"image":861,"draft":566},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":863,"title":864,"description":865,"published":866,"category":669,"image":867,"draft":566},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":869,"title":870,"description":871,"published":866,"category":562,"image":872,"draft":566},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":874,"title":875,"description":876,"published":877,"category":562,"image":878,"draft":566},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":880,"title":881,"description":882,"published":883,"category":562,"image":884,"draft":566},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":886,"title":887,"description":888,"published":889,"category":669,"image":890,"draft":566},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":892,"title":893,"description":894,"published":895,"category":562,"image":896,"draft":566},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":898,"title":899,"description":900,"published":901,"category":562,"image":902,"draft":566},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":904,"title":905,"description":906,"published":907,"category":562,"image":908,"draft":566},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":910,"title":911,"description":912,"published":913,"category":562,"image":914,"draft":566},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":916,"title":917,"description":918,"published":919,"category":562,"image":920,"draft":566},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":922,"title":923,"description":924,"published":925,"category":562,"image":926,"draft":566},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":928,"title":929,"description":930,"published":931,"category":562,"image":932,"draft":566},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":934,"title":935,"description":936,"published":937,"category":562,"image":938,"draft":566},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":940,"title":941,"description":942,"published":943,"category":669,"image":944,"draft":566},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":946,"title":947,"description":948,"published":949,"category":669,"image":950,"draft":566},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":952,"title":953,"description":954,"published":955,"category":669,"image":956,"draft":566},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":958,"title":959,"description":960,"published":961,"category":562,"image":962,"draft":566},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":964,"title":965,"description":966,"published":967,"category":562,"image":968,"draft":566},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":970,"title":971,"description":972,"published":973,"category":562,"image":974,"draft":566},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":388,"title":976,"description":977,"published":978,"category":562,"image":979,"draft":566},"How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":981,"title":982,"description":983,"published":984,"category":562,"image":985,"draft":566},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":987,"title":988,"description":989,"published":990,"category":562,"image":991,"draft":566},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":993,"title":994,"description":995,"published":996,"category":562,"image":997,"draft":566},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":999,"title":1000,"description":1001,"published":1002,"category":562,"image":1003,"draft":566},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1005,"title":1006,"description":1007,"published":1008,"category":562,"image":1009,"draft":566},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1011,"title":1012,"description":1013,"published":1014,"category":562,"image":1015,"draft":566},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1017,"title":1018,"description":1019,"published":1020,"category":669,"image":1021,"draft":566},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1023,"title":1024,"description":1025,"published":1026,"category":562,"image":1027,"draft":566},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1029,"title":1030,"description":1031,"published":1032,"category":669,"image":1033,"draft":566},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1035,"title":1036,"description":1037,"published":1038,"category":562,"image":1039,"draft":566},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":352,"title":1041,"description":1042,"published":1043,"category":562,"image":1044,"draft":566},"Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1046,"title":1047,"description":1048,"published":1049,"category":562,"image":1050,"draft":566},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1052,"title":1053,"description":1054,"published":1055,"category":562,"image":1056,"draft":566},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1058,"title":1059,"description":1060,"published":1061,"category":669,"image":1062,"draft":566},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1064,"title":1065,"description":1066,"published":1067,"category":669,"image":1068,"draft":566},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1070,"title":1071,"description":1072,"published":1073,"category":562,"image":1074,"draft":566},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1076,"title":1077,"description":1078,"published":1079,"category":562,"image":1080,"draft":566},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1082,"title":1083,"description":1084,"published":1085,"category":669,"image":1086,"draft":566},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1088,"title":1089,"description":1090,"published":1091,"category":562,"image":1092,"draft":566},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1094,"title":1095,"description":1096,"published":1091,"category":562,"image":1097,"draft":566},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":393,"title":1099,"description":1100,"published":1101,"category":562,"image":1102,"draft":566},"Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1104,"title":1105,"description":1106,"published":1107,"category":669,"image":1108,"draft":566},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1110,"title":1111,"description":1112,"published":1113,"category":562,"image":1114,"draft":566},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1116,"title":1117,"description":1118,"published":1113,"category":669,"image":1119,"draft":566},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1121,"title":1122,"description":1123,"published":1124,"category":669,"image":1125,"draft":566},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":546,"title":1127,"description":1128,"published":1124,"category":562,"image":1129,"draft":566},"Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]