[{"data":1,"prerenderedAt":794},["ShallowReactive",2],{"blog-en-supabase-point-in-time-recovery":3,"blog-index-en":444},{"id":4,"title":5,"body":6,"category":401,"cover":402,"coverAlt":403,"description":404,"draft":405,"extension":406,"faq":407,"image":422,"keywords":423,"meta":431,"navigation":432,"ogTitle":433,"path":434,"published":435,"seo":436,"stem":437,"tldr":438,"updated":435,"__hash__":443},"blog_en\u002Fblog\u002Fsupabase-point-in-time-recovery.md","Supabase point-in-time recovery: what it costs, what it misses",{"type":7,"value":8,"toc":387},"minimark",[9,13,16,19,24,27,30,33,44,48,51,54,98,101,109,112,116,119,127,130,136,143,147,150,157,166,170,173,176,184,188,191,194,199,202,205,209,212,291,294,298,320,324,327,332,364,372,379],[10,11,12],"p",{},"You are on the Supabase Pro plan, something went wrong at a time you could\nwrite down, and last night's backup is older than the mistake. Somewhere in the\ndashboard there is a toggle called Point in Time Recovery with a price beside\nit, and the question is whether that price buys what you think it buys.",[10,14,15],{},"Here is the part that gets flattened in every roundup: point-in-time recovery\nand a backup you hold are two different products, and turning on the first does\nnothing about what the second is for. Both are filed under Backups in the\ndashboard, which is most of the reason this is confusing.",[10,17,18],{},"It helps to think of one as a recording and the other as a photograph. A daily\nbackup is a photograph: one frame a day, taken at a fixed hour, and you can\ncarry it out of the building. Point-in-time recovery is the building's own\ncamera, running continuously, which lets you stop on any frame you like. The\ntapes are in the basement and they go back a week.",[20,21,23],"h2",{"id":22},"what-is-point-in-time-recovery-in-supabase","What is point-in-time recovery in Supabase?",[10,25,26],{},"It is a way to put your database back to a specific moment rather than to a\nspecific backup.",[10,28,29],{},"Supabase builds it out of two things running together. The first is a physical\nbackup, a snapshot of the database files taken daily. The second is Write Ahead\nLog archiving: Postgres keeps a running record of every change it makes, and\nSupabase copies those files away at two-minute intervals, or immediately when\none crosses a size threshold. A restore loads the snapshot and then replays the\nlog forward until it reaches the moment you asked for.",[10,31,32],{},"That mechanism is where the precision comes from. Supabase describes the result\nas up to seconds of granularity, with a worst case they put at a Recovery Point\nObjective of two minutes, which in plain terms is the most you could lose off\nthe end of the moment you picked.",[10,34,35,36,43],{},"Their ",[37,38,42],"a",{"href":39,"rel":40},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fplatform\u002Fbackups",[41],"nofollow","backup documentation","\nis the page to read for the current shape of all this. Everything below depends\non numbers that belong to them.",[20,45,47],{"id":46},"how-much-does-supabase-point-in-time-recovery-cost","How much does Supabase point-in-time recovery cost?",[10,49,50],{},"$100 a month for a seven-day window, on top of the Pro plan, which is $25 a\nmonth on its own.",[10,52,53],{},"Supabase bills the add-on by the hour and sells three window sizes:",[55,56,57,70],"table",{},[58,59,60],"thead",{},[61,62,63,67],"tr",{},[64,65,66],"th",{},"Recovery window",[64,68,69],{},"What Supabase charges",[71,72,73,82,90],"tbody",{},[61,74,75,79],{},[76,77,78],"td",{},"7 days",[76,80,81],{},"$0.137 an hour, about $100 a month",[61,83,84,87],{},[76,85,86],{},"14 days",[76,88,89],{},"$0.274 an hour",[61,91,92,95],{},[76,93,94],{},"28 days",[76,96,97],{},"$0.55 an hour",[10,99,100],{},"There is a second line on the bill, and it is the one that catches people out.\nPoint-in-time recovery requires at least the Small compute instance. A Pro\nproject runs on Micro by default, which the $10 of compute credits included in\nthe plan covers entirely; Small is around $15 a month, so the credits stop\ncovering your compute and the remainder starts appearing on your invoice. The\nadd-on is therefore a little more expensive than the number printed beside it.",[10,102,103,104,108],{},"It is available on Pro, Team and Enterprise. On the free plan there is nothing\nto add it to, because\n",[37,105,107],{"href":106},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","the free plan takes no automatic backups at all",".",[10,110,111],{},"Check both figures against Supabase's own pricing page on the day you decide\nrather than against this one. They are theirs to change, and this page will not\nnotice when they do.",[20,113,115],{"id":114},"when-is-point-in-time-recovery-worth-the-money","When is point-in-time recovery worth the money?",[10,117,118],{},"When you can name the minute, and when the work either side of it matters.",[10,120,121,122,126],{},"A migration ran at 14:32 and took a column with it. A script you started at\nlunchtime wrote the wrong value into every row. An\n",[37,123,125],{"href":124},"\u002Fblog\u002Fai-agent-deleted-my-database","AI agent was given write access and used it",".\nIn all three you know when, and knowing when is the whole input. You pick 14:31,\nand the database comes back as it stood one minute before the damage.",[10,128,129],{},"The clause that costs money is the rest of that morning. Restoring last\nmidnight's copy also removes every signup, order and message your users created\nsince midnight, so undoing one mistake means accepting a second, smaller loss.\nWith point-in-time recovery the morning's work stays.",[131,132],"diagram",{"alt":133,"caption":134,"src":135},"Two timelines carrying the same fault, marked with a cross. On the upper one a continuous run of small marks lets a marker stand immediately before the fault, and the bracket between them is short. On the lower one the marker stands on the last of five widely spaced documents, and the bracket reaching to the fault is several times longer.","The same accident on two timelines. The bracket is what you retype.","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fto-the-second-or-to-the-night-1600x560.png",[10,137,138,139,108],{},"While you are in the dashboard thinking about what could go wrong, it is worth\nknowing what your app already shows a stranger. Our free scan reads your live\nsite from outside and tells you what it can see. It takes about 20 seconds and\nneeds no account: ",[37,140,142],{"href":141},"\u002Fsecurity-scanner","scan your app",[20,144,146],{"id":145},"what-point-in-time-recovery-does-not-reach","What point-in-time recovery does not reach",[10,148,149],{},"Two: a mistake you notice after the window has moved on, and the account the\nwhole arrangement lives inside.",[10,151,152,156],{},[153,154,155],"strong",{},"A mistake you notice late."," The window moves with today, so a seven-day\nwindow is always the last seven days and never a fixed week. That is generous\nfor a deletion, which usually announces itself in minutes. It is no help at all\nwith the quiet kind: a form that has been saving the wrong value since Tuesday\nfortnight, a column dropped in a migration nobody read closely, a field one\nscript has been overwriting for a month. Those surface when a customer writes\nin, and a customer writing in is rarely within seven days of the cause.",[10,158,159,162,163,108],{},[153,160,161],{},"The account the recovery lives in."," The snapshots and the archived log sit\ninside your Supabase project, which makes them fast and makes them one click.\nIt also means a suspended project, an expired card or a login you cannot get\nback takes the recovery down with the thing it was there to recover. That is a\nfair trade and not a flaw, and it is the reason\n",[37,164,165],{"href":106},"a copy inside your account is only half a safety net",[20,167,169],{"id":168},"does-point-in-time-recovery-cover-my-storage-files","Does point-in-time recovery cover my Storage files?",[10,171,172],{},"No. Supabase's own wording is that database backups do not include objects you\nstore via the Storage API, and point-in-time recovery is a database feature.",[10,174,175],{},"Every avatar, uploaded PDF and product image your users added lives in Storage,\nwhich is a separate service. Your database holds the path to each file and none\nof their contents. So a database rewound to Tuesday points at whatever is in\nyour buckets today, and a file deleted on Wednesday is still deleted after a\nrecovery that worked perfectly.",[10,177,178,179,183],{},"Whatever else you decide on this page, your files need their own answer.\n",[37,180,182],{"href":181},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database","\ncovers where each route leaves them.",[20,185,187],{"id":186},"can-a-third-party-tool-give-me-point-in-time-recovery","Can a third-party tool give me point-in-time recovery?",[10,189,190],{},"No, and this is the one claim on the subject worth checking carefully, because\nit sounds like a feature comparison and it is a category difference.",[10,192,193],{},"Point-in-time recovery replays the write-ahead log, and that log is a file on\nthe disk your database runs on. Reading it means standing on that machine.\nEvery external backup tool, ours included, connects to your database the way\nyour app does, asks it for its contents, and writes the answer down. What comes\nout is a logical dump: a complete, portable copy of everything in the database\nat the moment the dump ran.",[131,195],{"alt":196,"caption":197,"src":198},"A dashed boundary around a database. Inside it, a continuous run of small marks feeds a saved file. A dashed line carrying that run towards the outside is crossed. A second line leaves the database, crosses the boundary and arrives as a saved file that is read back through a lens and ticked.","A tool outside the boundary can ask the database for its contents. The running log behind the boundary is not something it can be handed.","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fthe-log-stays-inside-1600x600.png",[10,200,201],{},"A dump is the photograph again. You can carry it anywhere, load it into a\nbrand-new project on a different account, and read it with ordinary Postgres\ntools that have never heard of Supabase. What you cannot do is stop between two\ndumps, because nothing was recording in between.",[10,203,204],{},"So the honest version of the comparison. If what you need is to land on 14:31,\nbuy Supabase's add-on; nobody outside the platform is able to sell you that. A\nvendor advertising point-in-time recovery over a connection is describing a\nschedule, and one question separates the two: does their restore land on a\nminute you type, or on the last time their copy ran?",[20,206,208],{"id":207},"point-in-time-recovery-or-a-copy-you-hold","Point-in-time recovery, or a copy you hold?",[10,210,211],{},"Ask which disaster you are insuring against, because these two answer different\nones.",[55,213,214,226],{},[58,215,216],{},[61,217,218,220,223],{},[64,219],{},[64,221,222],{},"Point-in-time recovery",[64,224,225],{},"A copy you hold",[71,227,228,239,250,259,269,280],{},[61,229,230,233,236],{},[76,231,232],{},"Puts you back to a named minute",[76,234,235],{},"Yes",[76,237,238],{},"To whenever a copy ran",[61,240,241,244,247],{},[76,242,243],{},"Reaches past the retention window",[76,245,246],{},"No",[76,248,249],{},"As far back as you keep copies",[61,251,252,255,257],{},[76,253,254],{},"Survives losing the Supabase account",[76,256,246],{},[76,258,235],{},[61,260,261,264,266],{},[76,262,263],{},"Includes Storage files",[76,265,246],{},[76,267,268],{},"Only if the copy was told to take them",[61,270,271,274,277],{},[76,272,273],{},"Where it lives",[76,275,276],{},"Inside your project",[76,278,279],{},"Wherever you put it",[61,281,282,285,288],{},[76,283,284],{},"What it costs",[76,286,287],{},"$100 a month and up, plus the compute",[76,289,290],{},"Free by hand, or a subscription",[10,292,293],{},"Most apps with real customers in them want both, and the order is what to be\ndeliberate about. A copy you hold is the one that survives everything, including\nthe account, so it is the one to arrange first. The add-on is what you buy once\nyou have worked out that losing a morning of orders would cost you more than it\ndoes.",[20,295,297],{"id":296},"what-to-do-this-week","What to do this week",[299,300,301],"key-takeaways",{},[302,303,304,308,311,314,317],"ul",{},[305,306,307],"li",{},"Find out whether the add-on is already switched on, in Database then Backups in your Supabase dashboard. It is possible to be paying for it and not know.",[305,309,310],{},"Write down how long a quiet mistake could sit unnoticed in your app. If that number is larger than seven days, a wider window is buying you less than it looks.",[305,312,313],{},"Arrange one copy of your database that lives outside your Supabase account, whichever way you take it. Point-in-time recovery does not do this job and is not trying to.",[305,315,316],{},"Back up your Storage files separately, because no database recovery on any plan includes them.",[305,318,319],{},"Restore something once, into a throwaway project, so the first time you read one of these copies is not during an incident.",[20,321,323],{"id":322},"where-reeve-care-fits","Where Reeve Care fits",[10,325,326],{},"Care is the copy you hold, arranged for you, with a restore you press rather\nthan assemble.",[131,328],{"alt":329,"caption":330,"src":331},"A Reeve Care panel with two rows. In the first, a database and an image leave a dashed account outline as a saved file that is locked, read back through a lens and ticked. In the second, a copy of the current state leaves the account first, numbered one, and then the chosen copy travels back into it from a card carrying a button, numbered two.","The copies stand outside the account they came from. Putting one back starts by taking another.","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcare-copy-out-and-button-back-1600x560.png",[302,333,334,340,346,352,358],{},[305,335,336,339],{},[153,337,338],{},"Copies run on a schedule you do not have to remember",", as often as every six hours on the higher plans, and a run that fails sends you an email rather than a silence.",[305,341,342,345],{},[153,343,344],{},"Each copy lives outside your Supabase account."," Encrypted, on storage we hold, so a suspended project or a lost login does not take your backups with it.",[305,347,348,351],{},[153,349,350],{},"Every copy is read back before it counts."," The date on your dashboard is the last copy that passed that check, never the last one attempted.",[305,353,354,357],{},[153,355,356],{},"Restoring is a button",", and it takes a snapshot of the current state before it starts, so the restore itself has an undo.",[305,359,360,363],{},[153,361,362],{},"The files your users uploaded are copied too",", once you connect your Storage buckets. That is a second key, asked for separately, because the key Supabase issues for Storage can write as well as read and we would rather ask than fold it in with one that cannot.",[10,365,366,367,371],{},"Care and the add-on are complementary, which is also how they are priced. Care\nstarts at $49 a month for one app, against $100 for the add-on, and plenty of\napps should have the first before they consider the second. Ours are list\nprices, and the ",[37,368,370],{"href":369},"\u002Fpricing","pricing page"," is sometimes below the figure here and\nnever above it. Every Supabase figure on this page is quoted from their own\npages, never converted or estimated.",[10,373,374,375,108],{},"How a copy is taken, checked and put back is drawn out step by step on the\n",[37,376,378],{"href":377},"\u002Fsupabase-backups","Supabase backups page",[10,380,381,382,386],{},"Before you close this tab, work out the number this whole decision turns on: how\nlong a mistake could sit in your app before somebody noticed it. Under seven\ndays and the add-on is buying you real precision on the day you need it. Longer\nthan that and a wider window is not where the money should go, because the thing\nthat reaches back further is a copy of your own. The\n",[37,383,385],{"href":384},"\u002Fchecklist","10-minute security checklist"," covers backups alongside the rest of\nwhat is worth confirming on a launched app.",{"title":388,"searchDepth":389,"depth":389,"links":390},"",3,[391,393,394,395,396,397,398,399,400],{"id":22,"depth":392,"text":23},2,{"id":46,"depth":392,"text":47},{"id":114,"depth":392,"text":115},{"id":145,"depth":392,"text":146},{"id":168,"depth":392,"text":169},{"id":186,"depth":392,"text":187},{"id":207,"depth":392,"text":208},{"id":296,"depth":392,"text":297},{"id":322,"depth":392,"text":323},"Backups","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcover-1200x630.png","A database beside a line of time, with a marker standing on one point inside the stretch that is recorded.","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.",false,"md",[408,410,413,416,419],{"q":47,"a":409},"Supabase prices it at $100 a month for a seven-day recovery window, on top of your Pro plan. There is a second cost that the headline figure leaves out: the add-on requires at least the Small compute instance, which is around $15 a month, and a Pro project runs on the smaller Micro instance by default. Read both numbers off their pricing page on the day you decide, because they are theirs to change.",{"q":411,"a":412},"Is point-in-time recovery included in the Supabase Pro plan?","No. Pro includes daily backups reaching back seven days, and point-in-time recovery is a paid add-on on top of that. Supabase offers it on the Pro, Team and Enterprise plans. The free plan has no automatic backups at all, so there is nothing there to add it to.",{"q":414,"a":415},"Can a third-party backup tool give me point-in-time recovery?","No, and a tool that implies otherwise is describing something else. Point-in-time recovery replays the write-ahead log, a file on the disk your database runs on, which means only the platform running that disk can read it. Every external tool connects the way your app does and asks the database for its contents, which produces a portable copy of one moment. That copy is genuinely useful and it is a different object.",{"q":417,"a":418},"Does point-in-time recovery back up my Supabase Storage files?","No. Supabase states plainly that database backups do not include objects you store via the Storage API, and point-in-time recovery is a database feature. Every avatar, PDF and image your users uploaded lives in a separate service, and rewinding the database to Tuesday leaves those files exactly as they are today. Backing them up is a separate job whichever route you take.",{"q":420,"a":421},"How far back can Supabase point-in-time recovery go?","As far as the window you pay for, and no further. Supabase sells retention in three sizes: seven days, fourteen days and twenty-eight days, at $0.137, $0.274 and $0.55 an hour respectively. The window moves with today, so every hour that passes pushes the oldest hour out the far end. A mistake made five weeks ago is outside all three.","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",[424,425,426,427,428,429,430],"point in time recovery supabase","supabase pitr","supabase pitr cost","supabase pitr vs daily backups","supabase disaster recovery","supabase wal archiving","do i need pitr supabase",{},true,"What Supabase point-in-time recovery costs","\u002Fblog\u002Fsupabase-point-in-time-recovery","2026-09-13",{"title":5,"description":404},"blog\u002Fsupabase-point-in-time-recovery",[439,440,441,442],"Supabase point-in-time recovery puts your database back to a moment you name, instead of back to last night's copy. It is an add-on on the Pro plan and above.","It costs $100 a month for a seven-day window, and switching it on also moves your project to a larger compute instance, which is billed separately.","No third-party backup tool can offer the same thing. Point-in-time recovery is built on the database's own write log, which only the platform holding the disk can read.","It covers your database. Your Storage files sit outside it, and so does a mistake you notice after the window has moved on.","KEMNBcLgHfCQjMG6n35mV4RlgRdF6lxPXiXA5Z68OCo",[445,452,458,464,470,476,482,488,494,500,506,512,518,524,530,536,541,547,553,559,565,571,577,583,589,595,601,607,613,614,620,626,632,638,644,650,656,662,668,674,680,686,692,698,704,710,716,722,728,734,740,746,751,757,762,768,773,779,784,789],{"path":446,"title":447,"description":448,"published":449,"category":450,"image":451,"draft":405},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","Security basics","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":453,"title":454,"description":455,"published":456,"category":450,"image":457,"draft":405},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":459,"title":460,"description":461,"published":462,"category":450,"image":463,"draft":405},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":465,"title":466,"description":467,"published":468,"category":450,"image":469,"draft":405},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":471,"title":472,"description":473,"published":474,"category":450,"image":475,"draft":405},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":477,"title":478,"description":479,"published":480,"category":450,"image":481,"draft":405},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":483,"title":484,"description":485,"published":486,"category":450,"image":487,"draft":405},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":489,"title":490,"description":491,"published":492,"category":450,"image":493,"draft":405},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":495,"title":496,"description":497,"published":498,"category":450,"image":499,"draft":405},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":501,"title":502,"description":503,"published":504,"category":450,"image":505,"draft":405},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":507,"title":508,"description":509,"published":510,"category":450,"image":511,"draft":405},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":513,"title":514,"description":515,"published":516,"category":450,"image":517,"draft":405},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":519,"title":520,"description":521,"published":522,"category":401,"image":523,"draft":405},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":525,"title":526,"description":527,"published":528,"category":401,"image":529,"draft":405},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":531,"title":532,"description":533,"published":534,"category":401,"image":535,"draft":405},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":537,"title":538,"description":539,"published":534,"category":450,"image":540,"draft":405},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":542,"title":543,"description":544,"published":545,"category":450,"image":546,"draft":405},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":548,"title":549,"description":550,"published":551,"category":450,"image":552,"draft":405},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":554,"title":555,"description":556,"published":557,"category":401,"image":558,"draft":405},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":560,"title":561,"description":562,"published":563,"category":450,"image":564,"draft":405},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":566,"title":567,"description":568,"published":569,"category":450,"image":570,"draft":405},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":572,"title":573,"description":574,"published":575,"category":450,"image":576,"draft":405},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":578,"title":579,"description":580,"published":581,"category":450,"image":582,"draft":405},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":584,"title":585,"description":586,"published":587,"category":450,"image":588,"draft":405},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":590,"title":591,"description":592,"published":593,"category":450,"image":594,"draft":405},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":596,"title":597,"description":598,"published":599,"category":450,"image":600,"draft":405},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":602,"title":603,"description":604,"published":605,"category":450,"image":606,"draft":405},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":608,"title":609,"description":610,"published":611,"category":401,"image":612,"draft":405},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":434,"title":5,"description":404,"published":435,"category":401,"image":422,"draft":405},{"path":615,"title":616,"description":617,"published":618,"category":401,"image":619,"draft":405},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":621,"title":622,"description":623,"published":624,"category":450,"image":625,"draft":405},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":627,"title":628,"description":629,"published":630,"category":450,"image":631,"draft":405},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":633,"title":634,"description":635,"published":636,"category":450,"image":637,"draft":405},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":639,"title":640,"description":641,"published":642,"category":450,"image":643,"draft":405},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":645,"title":646,"description":647,"published":648,"category":450,"image":649,"draft":405},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Ten tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":651,"title":652,"description":653,"published":654,"category":450,"image":655,"draft":405},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":657,"title":658,"description":659,"published":660,"category":450,"image":661,"draft":405},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":663,"title":664,"description":665,"published":666,"category":450,"image":667,"draft":405},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":669,"title":670,"description":671,"published":672,"category":450,"image":673,"draft":405},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":675,"title":676,"description":677,"published":678,"category":450,"image":679,"draft":405},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":681,"title":682,"description":683,"published":684,"category":401,"image":685,"draft":405},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":687,"title":688,"description":689,"published":690,"category":450,"image":691,"draft":405},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":693,"title":694,"description":695,"published":696,"category":401,"image":697,"draft":405},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":699,"title":700,"description":701,"published":702,"category":450,"image":703,"draft":405},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":705,"title":706,"description":707,"published":708,"category":450,"image":709,"draft":405},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":711,"title":712,"description":713,"published":714,"category":450,"image":715,"draft":405},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":717,"title":718,"description":719,"published":720,"category":450,"image":721,"draft":405},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":723,"title":724,"description":725,"published":726,"category":401,"image":727,"draft":405},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":729,"title":730,"description":731,"published":732,"category":401,"image":733,"draft":405},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":735,"title":736,"description":737,"published":738,"category":450,"image":739,"draft":405},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":741,"title":742,"description":743,"published":744,"category":450,"image":745,"draft":405},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":124,"title":747,"description":748,"published":749,"category":401,"image":750,"draft":405},"An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":752,"title":753,"description":754,"published":755,"category":450,"image":756,"draft":405},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":758,"title":759,"description":760,"published":755,"category":450,"image":761,"draft":405},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":763,"title":764,"description":765,"published":766,"category":450,"image":767,"draft":405},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase's new API keys: which one is safe in your app?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":106,"title":769,"description":770,"published":771,"category":401,"image":772,"draft":405},"Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":774,"title":775,"description":776,"published":777,"category":450,"image":778,"draft":405},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":780,"title":781,"description":782,"published":777,"category":401,"image":783,"draft":405},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":181,"title":785,"description":786,"published":787,"category":401,"image":788,"draft":405},"Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":790,"title":791,"description":792,"published":787,"category":450,"image":793,"draft":405},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1791618966336]