[{"data":1,"prerenderedAt":1136},["ShallowReactive",2],{"blog-en-supabase-invalid-login":3,"blog-index-en":607},{"id":4,"title":5,"body":6,"category":565,"cover":566,"coverAlt":567,"description":568,"draft":569,"extension":570,"faq":571,"image":587,"keywords":588,"meta":595,"navigation":596,"ogTitle":597,"path":598,"published":599,"seo":600,"stem":601,"tldr":602,"updated":599,"__hash__":606},"blog_en\u002Fblog\u002Fsupabase-invalid-login.md","\"Invalid login credentials\" in Supabase: the three causes",{"type":7,"value":8,"toc":552},"minimark",[9,13,24,27,35,40,43,64,94,97,101,104,110,116,122,131,137,141,148,161,168,174,177,255,262,266,269,272,275,288,292,295,306,332,335,339,342,345,348,357,368,378,385,390,394,397,433,436,442,445,449,452,461,475,484,504,508,539],[10,11,12],"p",{},"Somebody writes in to say they cannot log in to your app, and they are sure the\npassword is right. You try their address yourself and get the same red line\nunder the form:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","Invalid login credentials\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26],{},"Supabase returns \"Invalid login credentials\" for a wrong password. It returns\nexactly the same words for two other people: someone whose email has no account\nin your app, and someone who signed up with Google and has never had a password.\nYour Lovable, Bolt, v0, Cursor, Claude Code or Replit app is working as built.\nIt gives one answer to three different situations.",[10,28,29,30,34],{},"Here is the part that the obvious fix gets wrong: ",[31,32,33],"strong",{},"the vague message is\ndeliberate, and making it more helpful opens a hole."," What helps is finding out\nwhich of the three you are looking at, which your own dashboard can tell you,\nwhile the form goes on saying as little as it does now.",[36,37,39],"h2",{"id":38},"what-does-invalid-login-credentials-mean-in-supabase","What does \"Invalid login credentials\" mean in Supabase?",[10,41,42],{},"It means Supabase Auth, the part of Supabase that signs people in, refused an\nemail and password and is keeping the reason to itself.",[10,44,45,46,53,54,57,58,63],{},"The message is written into the Auth server's own code. In\n",[47,48,52],"a",{"href":49,"rel":50},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Fapi\u002Ftoken.go",[51],"nofollow","the function that handles a password sign-in",",\nthe same error is returned at three points: when no user has that email, when\nthe user has no password stored, and when the password does not match. Each\ntime the reply is HTTP 400 with the code ",[21,55,56],{},"invalid_credentials",", which Supabase's\n",[47,59,62],{"href":60,"rel":61},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fdebugging\u002Ferror-codes",[51],"error code reference","\ndescribes as \"Login credentials or grant type not recognized.\"",[10,65,66,67,70,71,74,75,78,79,81,82,84,85,88,89,93],{},"In your app it arrives as an ",[21,68,69],{},"AuthApiError"," from ",[21,72,73],{},"signInWithPassword",", with\n",[21,76,77],{},"error.code"," set to ",[21,80,56],{},". The same reference tells you to\n\"always use ",[21,83,77],{}," and ",[21,86,87],{},"error.name"," to identify errors\", and that matters\nlater, when you decide what your form says. If your users were signed in and\nthen thrown out, that is a different error with\n",[47,90,92],{"href":91},"\u002Fblog\u002Fsupabase-users-logged-out","a page of its own",".",[10,95,96],{},"Think of your sign-in form as the keypad beside a building's front door. A\nvisitor types a code and one lamp answers. Green opens the door. Red comes on\nfor a wrong code, for a code that was never given to anybody, and for a\nresident who has always come in through the side door with a badge and has\nnever had a code at all.",[36,98,100],{"id":99},"the-three-people-behind-the-message","The three people behind the message",[10,102,103],{},"Each of the three needs a different fix, so it is worth knowing which one you\nhave in front of you.",[10,105,106,109],{},[31,107,108],{},"The wrong password."," The account exists, it has a password, and what they\ntyped does not match it. That includes a password changed on another device and\nforgotten since, and a password manager filling in an old one.",[10,111,112,115],{},[31,113,114],{},"The address with no account."," Nobody in your project signed up with that\nemail. It can be a second address (the work one, when they signed up with a\npersonal one) or a typo made at sign-up that is now stored as their email.",[10,117,118,121],{},[31,119,120],{},"The account with no password."," They signed up with Google, GitHub or another\nsign-in button, and Supabase never stored a password for them. When they come\nback and type one, there is nothing to compare it with. The Auth server checks\nthat a password is stored before it looks at the one typed in, and an account\nwithout one gets the same 400.",[10,123,124,125,130],{},"People who signed up with a magic link, the sign-in link sent by email, are a\nvariation on the first case. Supabase's\n",[47,126,129],{"href":127,"rel":128},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Fapi\u002Fmagic_link.go",[51],"magic link code","\ncreates their account with a random password that nobody is ever shown, so any\npassword they type is a wrong one.",[132,133],"diagram",{"alt":134,"caption":135,"src":136},"Three people walk towards the same keypad: one holding a key with the wrong teeth, one drawn in a dashed outline because no account exists for them, and one carrying a badge instead of a key. Their three paths meet at the keypad, its single lamp lights red, and one identical reply comes out.","A wrong password, an unknown address and an account with no password all reach the same check, and all three get the same reply.","\u002Fblog\u002Fsupabase-invalid-login\u002Fthree-people-one-light-1600x760.png",[36,138,140],{"id":139},"how-do-i-tell-which-one-it-was","How do I tell which one it was?",[10,142,143,144,147],{},"Ask your own database. Every account in your project is a row in a table called\n",[21,145,146],{},"auth.users",", and that row says how the person signs in.",[10,149,150,151,156,157,160],{},"Supabase's ",[47,152,155],{"href":153,"rel":154},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fusers",[51],"guide to users","\ndescribes the field that matters: ",[21,158,159],{},"app_metadata.providers"," is \"the list of\nproviders that the user can use to sign in with\". A user \"can have multiple\nidentities\", so one person may have both a password and Google. Whether a\npassword is stored at all is in the column the server itself checks.",[10,162,163,164,167],{},"Open the ",[31,165,166],{},"SQL Editor"," in your Supabase dashboard and run this with the address\nthe person gave you:",[14,169,172],{"className":170,"code":171,"language":19},[17],"select email,\n       raw_app_meta_data->'providers' as signs_in_with,\n       coalesce(encrypted_password, '') \u003C> '' as has_password,\n       email_confirmed_at\nfrom auth.users\nwhere lower(email) = lower('person@example.com');\n",[21,173,171],{"__ignoreMap":23},[10,175,176],{},"It reads one row and never shows a password, only whether one exists.",[178,179,180,193],"table",{},[181,182,183],"thead",{},[184,185,186,190],"tr",{},[187,188,189],"th",{},"What comes back",[187,191,192],{},"What it means",[194,195,196,205,232,244],"tbody",{},[184,197,198,202],{},[199,200,201],"td",{},"No row",[199,203,204],{},"No account has that address in this project. Ask which other address they might have used",[184,206,207,229],{},[199,208,209,212,213,216,217,220,221,224,225,228],{},[21,210,211],{},"has_password"," is ",[21,214,215],{},"false",", and ",[21,218,219],{},"signs_in_with"," lists ",[21,222,223],{},"google",", ",[21,226,227],{},"github"," or similar",[199,230,231],{},"They signed up with that button and have never had a password",[184,233,234,241],{},[199,235,236,212,238],{},[21,237,211],{},[21,239,240],{},"true",[199,242,243],{},"The password they typed is wrong, or they signed up with a magic link and never knew theirs",[184,245,246,252],{},[199,247,248,251],{},[21,249,250],{},"email_confirmed_at"," is empty",[199,253,254],{},"They have not confirmed their email yet, which becomes a different message once the password is right",[10,256,257,258,261],{},"If you would rather click than type, ",[31,259,260],{},"Authentication → Users"," in the dashboard\nlists the same accounts.",[36,263,265],{"id":264},"the-account-that-never-had-a-password","The account that never had a password",[10,267,268],{},"Send them back to the button they used, or let them set a password through your\nreset link.",[10,270,271],{},"At the keypad, this is the resident who has always used the side door. There is\nno code on file for them, so every code they try is refused.",[10,273,274],{},"The first repair is on your sign-in page. If sign-up offers \"Continue with\nGoogle\", the sign-in page needs the same button, so somebody who signed up with\nit sees it when they come back.",[10,276,277,278,283,284,287],{},"If they would like a password as well, your \"Forgot password?\" link already does\nit. Supabase's\n",[47,279,282],{"href":280,"rel":281},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Fapi\u002Frecover.go",[51],"password reset code","\nsends the recovery email to any account it finds without checking how the\naccount was made. A Google user who follows the link and sets a new password can\nsign in either way afterwards. That depends on your app having the page that\nsets the new password, which calls ",[21,285,286],{},"supabase.auth.updateUser({ password })",". If\nthe reset link lands on a page that never asks for one, the person is signed in\nonce and still has no password.",[36,289,291],{"id":290},"email-not-confirmed-means-the-password-was-right","\"Email not confirmed\" means the password was right",[10,293,294],{},"It is a different message with a different code, and it only reaches somebody\nwho has already passed the password check.",[10,296,297,298,301,302,305],{},"In the same Auth server function, the check for a confirmed email comes after\nthe password check. So ",[21,299,300],{},"Email not confirmed",", code ",[21,303,304],{},"email_not_confirmed",", only\ncomes back to someone who typed an existing email and its correct password.\nSupabase's error reference words it as \"Signing in is not allowed for this user\nas the email address is not confirmed.\" At the keypad it is a different lamp:\nthe code was right, and the door stays shut until the move-in paperwork is done.",[10,307,308,309,312,313,318,319,322,323,327,328,93],{},"You see it when ",[31,310,311],{},"Confirm email"," is switched on for your project's Email\nprovider. Supabase's\n",[47,314,317],{"href":315,"rel":316},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fgeneral-configuration",[51],"configuration guide","\nsays users then \"will need to confirm their email address before signing in for\nthe first time.\" The fix is the email they have not clicked yet: tell them to\ncheck their inbox and spam folder, and offer to send it again with\n",[21,320,321],{},"supabase.auth.resend({ type: 'signup', email })",". If those emails are not\narriving at all, ",[47,324,326],{"href":325},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","the email rate limit","\nis the first thing to rule out. If they arrive and the link then says \"Email\nlink is invalid or has expired\",\n",[47,329,331],{"href":330},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","something probably opened it before they did",[10,333,334],{},"Because this message only appears after a correct password, telling the person\nto check their inbox gives a stranger nothing they did not already have.",[36,336,338],{"id":337},"why-the-message-stays-vague","Why the message stays vague",[10,340,341],{},"Because the helpful version would tell strangers who your users are.",[10,343,344],{},"Picture the keypad answering \"nobody lives in flat 4B\". Anyone walking past\ncould go down the list of flats and learn which ones are occupied.",[10,346,347],{},"Your form works the same way. If it said \"No account with that email\", anyone\nholding a list of addresses could type each one in and learn which belong to\nyour users. A breach of some other website leaves a list like that behind,\nsometimes with the passwords people used there. Once somebody knows which\naddresses are your users, they know whose old passwords are worth trying on your\napp, and who is likely to open an email that looks like it came from you.",[10,349,350,351,356],{},"Supabase applies the same rule wherever an address goes in. Its\n",[47,352,355],{"href":353,"rel":354},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Fapi\u002Fsignup.go",[51],"sign-up code",",\nasked to create an account for an email that is already registered and\nconfirmed, can hand back a made-up user with a random ID, through a function\nwhose comment says it exists to stop \"information about whether a user is\nregistered or not from leaking\". The password reset answers an unknown address\nwith the same empty success as a known one.",[10,358,359,360,363,364,367],{},"The sign-up side has a switch you control. That made-up user is what comes back\nwhen confirmation is required for both email and phone sign-ups. If either one\nis switched off (the phone one counts even when your app never uses phone\nsign-in), a registered address gets ",[21,361,362],{},"User already registered",", code\n",[21,365,366],{},"user_already_exists",", and your sign-up form becomes a list-checker of its own.",[10,369,370,371,374,375,377],{},"The helpful message also has to come from somewhere. Supabase will not tell your\napp whether an email has an account, so to print \"No account with that email\"\nyour app has to find out by itself. That means a lookup that works for a visitor\nwho has not logged in: a read of your ",[21,372,373],{},"profiles"," table that only succeeds if\nanyone can read the emails in it, or a database function that searches\n",[21,376,146],{}," for whoever asks. Either way, the list of your users becomes\nreadable from outside.",[10,379,380,381,93],{},"The first of those can be seen from outside, which is how our free scan looks\nfor it. It asks each table your app names how many rows a visitor with no login\ncould get, reads only the count, and takes about 20 seconds with no account:\n",[47,382,384],{"href":383},"\u002Fsecurity-scanner","scan your app",[132,386],{"alt":387,"caption":388,"src":389},"A stack of email addresses is fed through two sign-in forms. The top form names missing accounts, and the stack comes out split into two piles, one ticked and one crossed, with the ticked pile marked in amber. The bottom form gives every address the same answer, and the stack comes out as one even pile.","A form that names a missing account sorts any list of addresses into your users and everyone else. One answer for everybody leaves the list as it was.","\u002Fblog\u002Fsupabase-invalid-login\u002Fthe-list-checker-1600x720.png",[36,391,393],{"id":392},"what-to-put-on-your-sign-in-page-instead","What to put on your sign-in page instead",[10,395,396],{},"Keep the message vague, and put every way back in on the same page.",[398,399,400,407,413,419],"ul",{},[401,402,403,406],"li",{},[31,404,405],{},"One message for all three cases",", in plain words, with the other routes\nbeside it: \"That email and password do not match. If you signed up with\nGoogle, use the button below.\" It helps the Google user and tells a stranger\nnothing your sign-up page does not.",[401,408,409,412],{},[31,410,411],{},"Every method from your sign-up page."," The Google button, the magic link\nand the password field, all on the sign-in page too.",[401,414,415,418],{},[31,416,417],{},"A \"Forgot password?\" link to a page that sets one."," Supabase answers every\naddress the same way there, so it is safe to show, and it is how a person\nwith no password gets one.",[401,420,421,426,427,429,430,432],{},[31,422,423,424,93],{},"Decisions on ",[21,425,77],{}," Show your vague message for\n",[21,428,56],{},", and \"check your inbox\" with a resend button for\n",[21,431,304],{},". Supabase's error reference says to identify errors by\ntheir code rather than by matching the message text, and warns that HTTP\nstatus codes \"may change unexpectedly\".",[10,434,435],{},"In code, that is two branches:",[14,437,440],{"className":438,"code":439,"language":19},[17],"const { error } = await supabase.auth.signInWithPassword({ email, password })\nif (error?.code === 'email_not_confirmed') showCheckYourInbox(email)\nelse if (error) showSignInHelp()\n",[21,441,439],{"__ignoreMap":23},[10,443,444],{},"If a builder writes your sign-in page, you can paste these four points in as\nthe instruction, including the one about what the page must keep to itself.",[36,446,448],{"id":447},"keeping-your-sign-in-page-the-way-you-left-it","Keeping your sign-in page the way you left it",[10,450,451],{},"Two things can still go wrong after today: a later prompt rewrites the page to\nbe \"more helpful\", and a change somewhere else loses the accounts the page signs\npeople into.",[10,453,454],{},[31,455,456,460],{},[47,457,459],{"href":458},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking from outside:",[398,462,463,466,469,472],{},[401,464,465],{},"all nine checks every hour, on up to three apps, including how many rows a visitor with no login can count in the tables your app names",[401,467,468],{},"an email the day a re-scan grades your app lower than the one before",[401,470,471],{},"whether the app is up, every 60 seconds",[401,473,474],{},"a monthly report, in plain language, of what it saw",[10,476,477],{},[31,478,479,483],{},[47,480,482],{"href":481},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database,\naccounts included:",[398,485,486,489,492,495,498,501],{},[401,487,488],{},"an encrypted copy on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[401,490,491],{},"the auth schema your users' accounts live in, so they come back with everything else",[401,493,494],{},"each copy verified before it counts, by counting the rows in every table",[401,496,497],{},"your uploaded files as well, once you connect a Storage credential",[401,499,500],{},"a one-click restore, with a safety copy of the current state taken first",[401,502,503],{},"everything Monitor does",[36,505,507],{"id":506},"what-to-do-now","What to do now",[509,510,511],"key-takeaways",{},[398,512,513,519,522,525,528,536],{},[401,514,515,516,518],{},"Run the ",[21,517,146],{}," query with the address the person gave you, and read which of the three it is.",[401,520,521],{},"No row: ask which other address they might have signed up with.",[401,523,524],{},"No password: point them at the Google or GitHub button they used, or at your reset link.",[401,526,527],{},"A password, and still refused: send them the reset link.",[401,529,530,531,533,534,93],{},"Show one vague message for ",[21,532,56],{},", and \"check your inbox\" only for ",[21,535,304],{},[401,537,538],{},"Never add a check that tells a visitor whether an email has an account.",[10,540,541,542,546,547,551],{},"If the trouble starts one step earlier and new accounts are failing to be\ncreated, ",[47,543,545],{"href":544},"\u002Fblog\u002Fdatabase-error-saving-new-user","Database error saving new user","\ncovers that end of the form. The ",[47,548,550],{"href":549},"\u002Fchecklist","10-minute security checklist","\ncovers what else tends to be left open in a newly launched app.",{"title":23,"searchDepth":553,"depth":553,"links":554},3,[555,557,558,559,560,561,562,563,564],{"id":38,"depth":556,"text":39},2,{"id":99,"depth":556,"text":100},{"id":139,"depth":556,"text":140},{"id":264,"depth":556,"text":265},{"id":290,"depth":556,"text":291},{"id":337,"depth":556,"text":338},{"id":392,"depth":556,"text":393},{"id":447,"depth":556,"text":448},{"id":506,"depth":556,"text":507},"Security basics","\u002Fblog\u002Fsupabase-invalid-login\u002Fcover-1200x630.png","A door keypad with its one lamp lit red, and in front of it a badge the keypad has no slot for.","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.",false,"md",[572,575,578,581,584],{"q":573,"a":574},"Why does Supabase say invalid login credentials when the password is right?","Because the password may be right for an account that does not exist, or the account may have no password at all. Check that the email is the one they signed up with, and whether they signed up with Google or another sign-in button, which leaves the account without a password. One query on auth.users in the SQL Editor shows which it is.",{"q":576,"a":577},"Does \"Invalid login credentials\" mean the account does not exist?","Sometimes. Supabase returns the same message, with the same code, invalid_credentials, when there is no account with that email, when the account has no password and when the password is wrong. The message alone cannot tell you which, and it was built that way.",{"q":579,"a":580},"Why can a user who signed up with Google not log in with a password?","Because their account was created without one. Supabase checks that a password is stored before it compares the one typed in, and an account with none gets \"Invalid login credentials\". They can keep using the Google button, or use your app's reset-password link to set a password: Supabase sends that email to any account it finds, however it was made.",{"q":582,"a":583},"Should my login form tell users the email is not registered?","No. That message tells anyone who types an address whether it belongs to one of your users, and somebody with a list of leaked addresses can check them all. Your app would also need a lookup that answers the question for strangers, which is a second hole. Keep the message vague and show the other ways to sign in.",{"q":585,"a":586},"What is the difference between \"Invalid login credentials\" and \"Email not confirmed\"?","Supabase only returns \"Email not confirmed\" after the password has been checked and found correct. So the right person typed the right password, and the account is waiting for them to click the link in their confirmation email. It is safe to tell them to check their inbox and to offer to send the email again.","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",[589,590,591,592,56,593,594],"invalid login credentials supabase","invalid login credentials","supabase login not working","email not confirmed supabase","supabase user enumeration","supabase google user no password",{},true,"\"Invalid login credentials\" in Supabase","\u002Fblog\u002Fsupabase-invalid-login","2026-10-28",{"title":5,"description":568},"blog\u002Fsupabase-invalid-login",[603,604,605],"Supabase answers \"Invalid login credentials\" for three different people: someone who typed the wrong password, someone whose email has no account, and someone who signed up with Google and has never had a password.","It does this on purpose. A sign-in form that said which of the three it was would tell anyone holding a list of email addresses which of them belong to your users.","You can tell the three apart yourself with one query on auth.users. Your sign-in page should keep the message vague and offer every way the account could have been made.","dORDe3qm9ewZ1Ew75LlnXfnkAL9Used855jbvhQxYDY",[608,614,620,626,632,638,644,650,656,661,667,674,680,681,687,693,699,705,711,717,723,728,733,739,745,751,757,762,768,774,780,786,792,798,804,810,816,822,828,834,840,846,852,858,864,870,875,881,887,893,899,905,911,917,923,929,935,941,947,953,959,965,971,977,983,989,995,1001,1007,1013,1019,1025,1031,1037,1043,1049,1055,1061,1067,1073,1079,1085,1091,1097,1102,1108,1114,1120,1125,1131],{"path":609,"title":610,"description":611,"published":612,"category":565,"image":613,"draft":569},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":615,"title":616,"description":617,"published":618,"category":565,"image":619,"draft":569},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":621,"title":622,"description":623,"published":624,"category":565,"image":625,"draft":569},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":627,"title":628,"description":629,"published":630,"category":565,"image":631,"draft":569},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":633,"title":634,"description":635,"published":636,"category":565,"image":637,"draft":569},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":639,"title":640,"description":641,"published":642,"category":565,"image":643,"draft":569},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":645,"title":646,"description":647,"published":648,"category":565,"image":649,"draft":569},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":651,"title":652,"description":653,"published":654,"category":565,"image":655,"draft":569},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":330,"title":657,"description":658,"published":659,"category":565,"image":660,"draft":569},"Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":662,"title":663,"description":664,"published":665,"category":565,"image":666,"draft":569},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":668,"title":669,"description":670,"published":671,"category":672,"image":673,"draft":569},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":675,"title":676,"description":677,"published":678,"category":565,"image":679,"draft":569},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":598,"title":5,"description":568,"published":599,"category":565,"image":587,"draft":569},{"path":682,"title":683,"description":684,"published":685,"category":565,"image":686,"draft":569},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":688,"title":689,"description":690,"published":691,"category":565,"image":692,"draft":569},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":694,"title":695,"description":696,"published":697,"category":565,"image":698,"draft":569},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":700,"title":701,"description":702,"published":703,"category":565,"image":704,"draft":569},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":706,"title":707,"description":708,"published":709,"category":565,"image":710,"draft":569},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":712,"title":713,"description":714,"published":715,"category":565,"image":716,"draft":569},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":718,"title":719,"description":720,"published":721,"category":565,"image":722,"draft":569},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":325,"title":724,"description":725,"published":726,"category":565,"image":727,"draft":569},"Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":91,"title":729,"description":730,"published":731,"category":565,"image":732,"draft":569},"Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":734,"title":735,"description":736,"published":737,"category":565,"image":738,"draft":569},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":740,"title":741,"description":742,"published":743,"category":565,"image":744,"draft":569},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":746,"title":747,"description":748,"published":749,"category":565,"image":750,"draft":569},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":752,"title":753,"description":754,"published":755,"category":565,"image":756,"draft":569},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":544,"title":758,"description":759,"published":760,"category":565,"image":761,"draft":569},"\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":763,"title":764,"description":765,"published":766,"category":565,"image":767,"draft":569},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":769,"title":770,"description":771,"published":772,"category":565,"image":773,"draft":569},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":775,"title":776,"description":777,"published":778,"category":565,"image":779,"draft":569},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":781,"title":782,"description":783,"published":784,"category":565,"image":785,"draft":569},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":787,"title":788,"description":789,"published":790,"category":565,"image":791,"draft":569},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":793,"title":794,"description":795,"published":796,"category":565,"image":797,"draft":569},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":799,"title":800,"description":801,"published":802,"category":565,"image":803,"draft":569},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":805,"title":806,"description":807,"published":808,"category":565,"image":809,"draft":569},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":811,"title":812,"description":813,"published":814,"category":565,"image":815,"draft":569},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":817,"title":818,"description":819,"published":820,"category":565,"image":821,"draft":569},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":823,"title":824,"description":825,"published":826,"category":565,"image":827,"draft":569},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":829,"title":830,"description":831,"published":832,"category":565,"image":833,"draft":569},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":835,"title":836,"description":837,"published":838,"category":565,"image":839,"draft":569},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":841,"title":842,"description":843,"published":844,"category":565,"image":845,"draft":569},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":847,"title":848,"description":849,"published":850,"category":565,"image":851,"draft":569},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":853,"title":854,"description":855,"published":856,"category":672,"image":857,"draft":569},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":859,"title":860,"description":861,"published":862,"category":672,"image":863,"draft":569},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":865,"title":866,"description":867,"published":868,"category":672,"image":869,"draft":569},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":871,"title":872,"description":873,"published":868,"category":565,"image":874,"draft":569},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":876,"title":877,"description":878,"published":879,"category":565,"image":880,"draft":569},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":882,"title":883,"description":884,"published":885,"category":565,"image":886,"draft":569},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":888,"title":889,"description":890,"published":891,"category":672,"image":892,"draft":569},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":894,"title":895,"description":896,"published":897,"category":565,"image":898,"draft":569},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":900,"title":901,"description":902,"published":903,"category":565,"image":904,"draft":569},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":906,"title":907,"description":908,"published":909,"category":565,"image":910,"draft":569},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":912,"title":913,"description":914,"published":915,"category":565,"image":916,"draft":569},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":918,"title":919,"description":920,"published":921,"category":565,"image":922,"draft":569},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":924,"title":925,"description":926,"published":927,"category":565,"image":928,"draft":569},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":930,"title":931,"description":932,"published":933,"category":565,"image":934,"draft":569},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":936,"title":937,"description":938,"published":939,"category":565,"image":940,"draft":569},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":942,"title":943,"description":944,"published":945,"category":672,"image":946,"draft":569},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":948,"title":949,"description":950,"published":951,"category":672,"image":952,"draft":569},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":954,"title":955,"description":956,"published":957,"category":672,"image":958,"draft":569},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":960,"title":961,"description":962,"published":963,"category":565,"image":964,"draft":569},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":966,"title":967,"description":968,"published":969,"category":565,"image":970,"draft":569},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":972,"title":973,"description":974,"published":975,"category":565,"image":976,"draft":569},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":978,"title":979,"description":980,"published":981,"category":565,"image":982,"draft":569},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":984,"title":985,"description":986,"published":987,"category":565,"image":988,"draft":569},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":990,"title":991,"description":992,"published":993,"category":565,"image":994,"draft":569},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":996,"title":997,"description":998,"published":999,"category":565,"image":1000,"draft":569},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1002,"title":1003,"description":1004,"published":1005,"category":565,"image":1006,"draft":569},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1008,"title":1009,"description":1010,"published":1011,"category":565,"image":1012,"draft":569},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1014,"title":1015,"description":1016,"published":1017,"category":565,"image":1018,"draft":569},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1020,"title":1021,"description":1022,"published":1023,"category":672,"image":1024,"draft":569},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1026,"title":1027,"description":1028,"published":1029,"category":565,"image":1030,"draft":569},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1032,"title":1033,"description":1034,"published":1035,"category":672,"image":1036,"draft":569},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1038,"title":1039,"description":1040,"published":1041,"category":565,"image":1042,"draft":569},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1044,"title":1045,"description":1046,"published":1047,"category":565,"image":1048,"draft":569},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1050,"title":1051,"description":1052,"published":1053,"category":565,"image":1054,"draft":569},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1056,"title":1057,"description":1058,"published":1059,"category":565,"image":1060,"draft":569},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1062,"title":1063,"description":1064,"published":1065,"category":672,"image":1066,"draft":569},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1068,"title":1069,"description":1070,"published":1071,"category":672,"image":1072,"draft":569},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1074,"title":1075,"description":1076,"published":1077,"category":565,"image":1078,"draft":569},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1080,"title":1081,"description":1082,"published":1083,"category":565,"image":1084,"draft":569},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1086,"title":1087,"description":1088,"published":1089,"category":672,"image":1090,"draft":569},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1092,"title":1093,"description":1094,"published":1095,"category":565,"image":1096,"draft":569},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1098,"title":1099,"description":1100,"published":1095,"category":565,"image":1101,"draft":569},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1103,"title":1104,"description":1105,"published":1106,"category":565,"image":1107,"draft":569},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1109,"title":1110,"description":1111,"published":1112,"category":672,"image":1113,"draft":569},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1115,"title":1116,"description":1117,"published":1118,"category":565,"image":1119,"draft":569},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1121,"title":1122,"description":1123,"published":1118,"category":672,"image":1124,"draft":569},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1126,"title":1127,"description":1128,"published":1129,"category":672,"image":1130,"draft":569},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1132,"title":1133,"description":1134,"published":1129,"category":565,"image":1135,"draft":569},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]