[{"data":1,"prerenderedAt":799},["ShallowReactive",2],{"blog-en-supabase-project-paused-recover":3,"blog-index-en":452},{"id":4,"title":5,"body":6,"category":405,"cover":406,"coverAlt":407,"description":408,"draft":409,"extension":410,"faq":411,"image":429,"keywords":430,"meta":438,"navigation":439,"ogTitle":440,"path":441,"published":442,"seo":443,"stem":444,"tldr":445,"updated":450,"__hash__":451},"blog_en\u002Fblog\u002Fsupabase-project-paused-recover.md","Supabase project paused? Your data is still there",{"type":7,"value":8,"toc":391},"minimark",[9,13,16,19,24,27,30,41,45,48,51,54,58,61,64,98,101,109,113,116,125,131,134,138,141,144,153,220,223,228,231,235,238,246,249,262,266,269,272,283,291,295,320,324,327,332,364,371,383],[10,11,12],"p",{},"Your app stopped answering. Every request comes back as an error, and when you\nopen your Supabase dashboard the project has the word Paused beside its name,\nwith a Restore button where the usual panels used to be. Nothing you deployed\ncaused it, and nothing warned you it was coming.",[10,14,15],{},"Here is where the two usual answers both go wrong. One says your database is\ngone, which was never true. The other says relax, because a Supabase project\npaused for inactivity still holds all of its data, so press Restore and get on\nwith your day. That one is true today and quietly stops being true on a date\nnobody mentions.",[10,17,18],{},"It helps to think of the project as a storage unit. The rent stopped, so the\nlights are off and the door is locked. Your boxes are inside, exactly as you\nleft them. That is where your project is standing right now, and there is a date\nafter which the unit gets cleared out.",[20,21,23],"h2",{"id":22},"is-a-paused-supabase-project-deleted","Is a paused Supabase project deleted?",[10,25,26],{},"No. The project is stopped, and stopping is not removing. Your tables, your\nrows, your Row Level Security policies and the files your users uploaded are all\nstill sitting on disk. What has been switched off is the database in front of\nthem, which is why your app gets an error for every request it makes.",[10,28,29],{},"That gap is what makes the panic reasonable. From the outside the app is broken\nthe way an app breaks when its database has gone: empty lists, loaders that\nnever finish, an error on every save. From the dashboard it is a project with a\nbutton on it.",[10,31,32,33,40],{},"Supabase pauses projects on the free plan and only on the free plan. In their\nown words they \"may pause applications on the Free Plan that exhibit low\nactivity in a 7-day period to save on server resources\", and paid projects are\nnot paused for inactivity at all. Their\n",[34,35,39],"a",{"href":36,"rel":37},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fplatform\u002Ffree-project-pausing",[38],"nofollow","project pausing page","\nis the one to read, because everything below depends on numbers that are theirs\nto change.",[20,42,44],{"id":43},"why-did-supabase-pause-my-project","Why did Supabase pause my project?",[10,46,47],{},"Because nothing talked to it for about a week.",[10,49,50],{},"Activity means requests. Opening the project in the dashboard counts. Your app\ncalling the database counts. What does not count is your app merely existing, so\na project that launched last month and has not found visitors yet is the exact\nshape that gets paused. The apps this happens to are almost never the busy ones.",[10,52,53],{},"The free plan also allows two active projects at a time, and paused ones stop\ncounting against that limit. So a project you parked on purpose and a project\nthat stopped on its own sit side by side in the dashboard looking the same, and\nboth are now on the same one-year clock.",[20,55,57],{"id":56},"how-do-i-restore-a-paused-supabase-project","How do I restore a paused Supabase project?",[10,59,60],{},"Open the dashboard, pick the project, and press Restore. Inside the window that\nis the whole procedure, and it is a few minutes of waiting rather than a\nmigration.",[10,62,63],{},"What comes back is the project you had. The same project ref, so the same API\nURL. The same tables, the same policies, the same storage buckets. Supabase\nbrings free projects up on the latest minor Postgres version as part of the\nrestore, which you will not notice.",[10,65,66,67,71,72,75,76,81,82,84,85,88,89,92,93,97],{},"The keys are the part that may not come back as they were. Supabase has warned\nthat projects restored since 1 November 2025 no longer receive the legacy keys,\n",[68,69,70],"code",{},"anon"," and ",[68,73,74],{},"service_role",": in ",[34,77,80],{"href":78,"rel":79},"https:\u002F\u002Fgithub.com\u002Forgs\u002Fsupabase\u002Fdiscussions\u002F29260",[38],"its own\nwords",", \"paused projects\nthat are restored risk being broken as they won't have the legacy keys\". If your\napp still sends the older ",[68,83,70],{}," key, a long string beginning ",[68,86,87],{},"eyJ",", expect its\nrequests to be refused once the project is back. The fix is the project's\npublishable key, which begins ",[68,90,91],{},"sb_publishable_",", in your builder's environment\nsettings. ",[34,94,96],{"href":95},"\u002Fblog\u002Fsupabase-new-api-keys","The two key formats"," are compared side\nby side.",[10,99,100],{},"Do one thing before you close the tab: take a copy of the data while the\ndatabase is running. A paused project is the one state in which you cannot\nexport anything, and the reason to do it today rather than next week is the\nclock in the next section.",[10,102,103,104,108],{},"While your app is back up, it is also worth knowing what it exposes to a\nstranger. Our free scan reads your live site from outside and tells you what it\nfinds. It takes about 20 seconds and needs no account:\n",[34,105,107],{"href":106},"\u002Fsecurity-scanner","scan your app",".",[20,110,112],{"id":111},"how-long-do-i-have-to-restore-it","How long do I have to restore it?",[10,114,115],{},"One year from the day it paused. Supabase's wording is that \"once the project is\npaused, there is a 1-year window to restore the project on the platform from\nwithin Supabase Studio\".",[10,117,118,119,124],{},"Check that number rather than trusting it, because it has already moved once.\nWhen the limit was\n",[34,120,123],{"href":121,"rel":122},"https:\u002F\u002Fsupabase.com\u002Fchangelog\u002F27497-paused-free-plan-projects-are-restorable-for-90-days",[38],"introduced in June 2024","\nit was 90 days, and anything written about paused projects before Supabase\nwidened it still says 90. Their own troubleshooting article is the clearest sign\nof it: the page says one year, and the URL it lives at still says 90 days.",[126,127],"diagram",{"alt":128,"caption":129,"src":130},"A timeline. It starts at a pause mark, runs through a long highlighted band holding a key, and continues past the end of the band to a saved file and a bucket. Further along, a crossed-out empty outline.","Inside the band, one button gives you the project back. Past it you can still collect the data, and further along there is nothing left to collect.","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fthe-restore-window-1600x520.png",[10,132,133],{},"Work out the date and put it in a calendar while you are thinking about it. It\nis one year from the day the project paused, which is almost never one year from\nthe day you noticed.",[20,135,137],{"id":136},"there-is-no-restore-button-what-happens-now","There is no Restore button. What happens now?",[10,139,140],{},"You get a download instead of a restore, and that difference is larger than it\nsounds.",[10,142,143],{},"Once the window has closed, Supabase replaces the restore option with two\nthings you can take away: the latest logical backup, taken right before the\nproject was paused, and all of your Storage objects. Both come off the project's\noverview page. Your data is in those files. Your project is not, and it is not\ncoming back.",[10,145,146,147,152],{},"Supabase documents\n",[34,148,151],{"href":149,"rel":150},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Frestore-project-after-90-days-pause",[38],"the migration that follows",".\nIt is five steps, and between them they want a Postgres client, the Supabase CLI\nand a Management API access token.",[154,155,156,169],"table",{},[157,158,159],"thead",{},[160,161,162,166],"tr",{},[163,164,165],"th",{},"What you get back",[163,167,168],{},"How it gets there",[170,171,172,188,196,204,212],"tbody",{},[160,173,174,178],{},[175,176,177],"td",{},"Tables, rows, column types, indexes and Row Level Security policies",[175,179,180,181,184,185],{},"Inside the ",[68,182,183],{},".backup"," file, replayed into a fresh project with ",[68,186,187],{},"psql",[160,189,190,193],{},[175,191,192],{},"The files your users uploaded",[175,194,195],{},"Downloaded separately from the overview page, then copied into the new buckets with the Supabase CLI",[160,197,198,201],{},[175,199,200],{},"Auth, Realtime, Storage and API settings",[175,202,203],{},"Supabase publishes a script that copies them across through their Management API",[160,205,206,209],{},[175,207,208],{},"Extensions, database webhooks and Realtime publications",[175,210,211],{},"You switch them back on by hand in the new project",[160,213,214,217],{},[175,215,216],{},"Your API URL and your keys",[175,218,219],{},"You do not get these back. A new project has a new project ref, so the URL and every key change with it, and everything holding the old ones has to be updated",[10,221,222],{},"That last row is the one people find out about too late. The address your app\nhas been using is part of the project you just lost, so a rebuild is not only a\ndata job. Your builder's environment variables, anything you pasted into the\ncode directly, any webhook or payment provider or analytics tool pointing at the\nold URL: each of those is a place the app breaks after the data is safely back.",[126,224],{"alt":225,"caption":226,"src":227},"Two lanes. In the upper one a paused project is opened with a key and continues as the same project, its connection to the app unbroken. In the lower one the project becomes a saved file and a bucket of files, which feed a different project, and the line from the app to it is dashed and crossed.","Both lanes end with your rows in a database. Only one of them ends with the app still pointing at the right place.","\u002Fblog\u002Fsupabase-project-paused-recover\u002Frestore-or-rebuild-1600x600.png",[10,229,230],{},"There is one more line after that, and it has no recovery attached. Supabase's\nown note is blunt: once a project is deleted, all associated data including\nbackups is permanently removed and cannot be recovered. If your dashboard is\ncurrently offering you downloads, take them now.",[20,232,234],{"id":233},"does-the-free-plan-keep-a-backup-while-my-project-is-paused","Does the free plan keep a backup while my project is paused?",[10,236,237],{},"There is exactly one, and it is not the safety net most people picture.",[10,239,240,241,245],{},"The free plan takes no scheduled backups at all. Nothing is copied anywhere\nwhile your project is running, which is\n",[34,242,244],{"href":243},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","worth knowing before anything goes wrong","\nrather than during. The copy that appears in your dashboard when the restore\nwindow closes is a single logical backup taken at the moment of the pause, and\nit becomes available to download at precisely the point you can no longer\nrestore.",[10,247,248],{},"Two things follow. The copy is dated the day your project stopped, which turns\nout to be fine, because a paused project has not accepted a write since then.\nAnd it lives in the same account as the project it came from, behind the same\nlogin, covered by the same deletion. It is in the unit, behind the same door.",[10,250,251,252,256,257,261],{},"The moment to take your own copy is while the project is running again.\n",[34,253,255],{"href":254},"\u002Fblog\u002Fback-up-supabase-free-tier","Making one from the dashboard without touching a terminal","\nis the free-plan route, and\n",[34,258,260],{"href":259},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","three ways to back up a Supabase database","\ncompares what each one costs you.",[20,263,265],{"id":264},"how-do-i-stop-it-pausing-again","How do I stop it pausing again?",[10,267,268],{},"Give the project something to answer every few days, or take it off the free\nplan.",[10,270,271],{},"Supabase counts opening the project in the dashboard and \"making API calls to\nyour project or sending requests via your connected application\" as activity. So\na scheduled job that calls your database once a day is enough to keep the\ncounter alive, and a small cron service or a scheduled workflow in your code\nrepository is the usual way to arrange one.",[273,274,276],"callout",{"type":275},"warn",[10,277,278,282],{},[279,280,281],"strong",{},"A ping keeps the project awake and does nothing else."," It is not a backup, it\ndoes not tell you when your app breaks for any of the other reasons apps break,\nand a scheduled job that quietly stopped firing looks exactly like one that is\nstill running. Whatever is doing the pinging needs to be something you would\nnotice failing, or the first news you get is the same Paused badge you are\nlooking at now.",[10,284,285,286,290],{},"Upgrading to Pro removes the question rather than managing it. Paid projects are\nnot paused for inactivity, and Pro is also where Supabase's own daily backups\nbegin, reaching back seven days. ",[34,287,289],{"href":288},"\u002Fblog\u002Fsupabase-free-plan-limits","What else Pro changes, limit by limit",", has an article of its own.",[20,292,294],{"id":293},"what-to-do-this-week","What to do this week",[296,297,298],"key-takeaways",{},[299,300,301,308,311,314,317],"ul",{},[302,303,304,305,307],"li",{},"Press Restore today if the button is there. It is a few minutes, and it is the only route that keeps your URL. If your app still uses the older ",[68,306,70],{}," key, give it the publishable key once the project is back.",[302,309,310],{},"If the button has gone, download both the backup file and your Storage files before anything else. A deleted project takes them with it.",[302,312,313],{},"Take your own copy of the database as soon as the project is running, because the free plan is not taking one for you.",[302,315,316],{},"Put something on a timer that calls your project, and make sure you would notice if that timer stopped.",[302,318,319],{},"Keep one copy of your data outside your Supabase account, where a pause, an expired window or a deletion cannot reach it.",[20,321,323],{"id":322},"where-reeve-care-fits","Where Reeve Care fits",[10,325,326],{},"A pause is an outage that does not look like one. Your pages still load, because\nyour builder is serving them; it is everything behind them that stopped. That is\na large part of why nobody told you.",[126,328],{"alt":329,"caption":330,"src":331},"A Reeve Care panel with two rows. In the first, a dashed outline of a Supabase account is crossed out while saved files stand outside it, ticked. In the second, a site is watched through a lens and an alert is raised.","The copies stand outside the account they came from. The app is watched from outside as well, and a check that stops getting an answer raises something.","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcare-outside-and-watching-1600x520.png",[299,333,334,340,346,352,358],{},[302,335,336,339],{},[279,337,338],{},"A paused project cannot be copied, and a copy that fails sends you an\nemail."," Care connects to your database on its own schedule rather than\nwaiting for your app to notice, so the night it stops answering is the night\nyou hear about it.",[302,341,342,345],{},[279,343,344],{},"The copy lives outside your Supabase account."," Encrypted, on storage we\nhold, so a project that paused, expired or was deleted does not take the\nbackups down with it.",[302,347,348,351],{},[279,349,350],{},"Every copy is read back before it counts."," The date on your dashboard is the\nlast backup that passed that check, never the last one attempted.",[302,353,354,357],{},[279,355,356],{},"Restoring is a button",", and it takes a snapshot of the current state before\nit starts, so the restore has an undo of its own.",[302,359,360,363],{},[279,361,362],{},"The files your users uploaded are copied too",", once you connect your Storage\nbuckets. That is a second key and it is optional, because the key Supabase\nissues for Storage can write as well as read, and we would rather ask for it\nseparately than fold it in with one that cannot.",[10,365,366,367,370],{},"Two limits, before you decide anything. Care backs up ",[279,368,369],{},"Supabase"," and nothing\nelse today, and if your data lives somewhere else we say so before you pay\nrather than after. And none of this stops a project pausing: the pause happens\ninside Supabase, where we are a client like any other. What it changes is where\nyour data is standing on the day it does.",[10,372,373,374,378,379,108],{},"Keep Supabase's own backups switched on as well, the day you move to a paid\nplan. Two copies in two places is the whole idea, and the cheaper of the two is\nalready in your bill. What each plan includes is on the\n",[34,375,377],{"href":376},"\u002Fpricing","pricing page",", and the copy, the check and the restore are drawn out\nstep by step on the ",[34,380,382],{"href":381},"\u002Fsupabase-backups","Supabase backups page",[10,384,385,386,390],{},"Before you close this tab, open your dashboard and look at which of the two\nbuttons your project is offering you. That one fact decides whether today is\nfive minutes of waiting or a rebuild, and the\n",[34,387,389],{"href":388},"\u002Fchecklist","10-minute security checklist"," covers backups alongside the rest of\nwhat is worth confirming once your app is answering again.",{"title":392,"searchDepth":393,"depth":393,"links":394},"",3,[395,397,398,399,400,401,402,403,404],{"id":22,"depth":396,"text":23},2,{"id":43,"depth":396,"text":44},{"id":56,"depth":396,"text":57},{"id":111,"depth":396,"text":112},{"id":136,"depth":396,"text":137},{"id":233,"depth":396,"text":234},{"id":264,"depth":396,"text":265},{"id":293,"depth":396,"text":294},{"id":322,"depth":396,"text":323},"Backups","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcover-1200x630.png","A pause mark beside a closed project box, with the database and the uploaded files still standing inside it.","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.",false,"md",[412,414,417,420,423,426],{"q":23,"a":413},"No. A pause stops the database from running; it does not remove anything. Your tables, rows, Row Level Security policies and uploaded files are all still on disk, which is why the dashboard offers you a Restore button rather than an apology. What a pause does break is your app, because every request it makes now comes back as an error.",{"q":415,"a":416},"How long do I have to restore a paused Supabase project?","One year from the day it paused, according to Supabase, who describe it as a 1-year window to restore the project from within Supabase Studio. That number has moved before: it was 90 days when the limit was introduced in June 2024, and the troubleshooting article Supabase publishes on the subject still carries 90 days in its URL. Read the current figure off their project pausing page rather than off anyone else.",{"q":418,"a":419},"There is no Restore button on my project. What now?","The restore window has closed, and Supabase has swapped that button for two downloads: the latest logical backup, taken right before the project was paused, and all of your Storage files. Both sit on the project overview page. Your data is in them, and getting back to a working app means creating a new project and replaying those files into it. Download both today, because a deleted project takes its backups with it permanently.",{"q":421,"a":422},"Will my project URL and API keys stay the same?","If you press Restore inside the window, the URL does: the project comes back with the same project ref your URL is built from. The keys may not. Supabase has warned that projects restored since 1 November 2025 come back without the legacy anon and service_role keys, so an app still using the anon key needs the project's publishable key instead. If you have to rebuild into a new project, both change: a new project has a new ref, so the API URL and every key change with it. That means updating your builder environment variables and anything that has the old address written down, including webhooks and third-party services.",{"q":424,"a":425},"How do I stop Supabase pausing my project again?","Give it something to answer at least once a week, or move it off the free plan. Supabase counts opening the dashboard and requests from your connected application as activity, so a scheduled job that calls your project once a day keeps the counter alive. Upgrading to Pro removes the question entirely, since paid projects are not paused for inactivity, and it is also where daily backups start.",{"q":427,"a":428},"My project is gone from the dashboard, not paused. Can I get it back?","Establish which one you have first, because they are different situations. A paused project is still listed, with Restore beside its name and the data frozen on disk. If it is not listed at all, the dashboard offers no undelete control: what is left is a support ticket with Supabase and a copy you made yourself. That second one is the whole argument for having a backup before the day you need it.","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",[431,432,433,434,435,436,437],"supabase project paused","supabase free tier paused","restore paused supabase project","supabase recover deleted project","supabase resume project","supabase inactive 7 days","keep supabase project active",{},true,"Supabase project paused? What to do next","\u002Fblog\u002Fsupabase-project-paused-recover","2026-09-12",{"title":5,"description":408},"blog\u002Fsupabase-project-paused-recover",[446,447,448,449],"A Supabase project paused for inactivity is not a deleted one. The data is frozen on disk and the dashboard has a Restore button beside the project name.","You have one year from the day it paused to restore it from the Supabase dashboard. Free projects pause after about a week of low activity.","After that year the Restore button is replaced by a download, and the only way back is a new project with a new URL and new keys.","The free plan copies nothing while your project is running, so the only backup that exists is the one taken the moment it paused.","2026-09-30","aaqincvsI8v3Gdhccj5XlToPpygzKmSJ3gSx8PdLO-A",[453,460,466,472,478,484,490,496,502,508,514,519,524,530,536,542,547,553,559,565,571,577,583,589,595,601,607,613,619,625,626,632,638,644,650,656,662,668,674,680,686,692,698,703,709,715,721,727,733,739,745,751,757,763,768,773,778,784,789,794],{"path":454,"title":455,"description":456,"published":457,"category":458,"image":459,"draft":409},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","Security basics","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":461,"title":462,"description":463,"published":464,"category":458,"image":465,"draft":409},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":467,"title":468,"description":469,"published":470,"category":458,"image":471,"draft":409},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":473,"title":474,"description":475,"published":476,"category":458,"image":477,"draft":409},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":479,"title":480,"description":481,"published":482,"category":458,"image":483,"draft":409},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":485,"title":486,"description":487,"published":488,"category":458,"image":489,"draft":409},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":491,"title":492,"description":493,"published":494,"category":458,"image":495,"draft":409},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":497,"title":498,"description":499,"published":500,"category":458,"image":501,"draft":409},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":503,"title":504,"description":505,"published":506,"category":458,"image":507,"draft":409},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":509,"title":510,"description":511,"published":512,"category":458,"image":513,"draft":409},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":515,"title":516,"description":517,"published":450,"category":458,"image":518,"draft":409},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":288,"title":520,"description":521,"published":522,"category":458,"image":523,"draft":409},"Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":525,"title":526,"description":527,"published":528,"category":405,"image":529,"draft":409},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":531,"title":532,"description":533,"published":534,"category":405,"image":535,"draft":409},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":537,"title":538,"description":539,"published":540,"category":405,"image":541,"draft":409},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":543,"title":544,"description":545,"published":540,"category":458,"image":546,"draft":409},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":548,"title":549,"description":550,"published":551,"category":458,"image":552,"draft":409},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":554,"title":555,"description":556,"published":557,"category":458,"image":558,"draft":409},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":560,"title":561,"description":562,"published":563,"category":405,"image":564,"draft":409},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":566,"title":567,"description":568,"published":569,"category":458,"image":570,"draft":409},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":572,"title":573,"description":574,"published":575,"category":458,"image":576,"draft":409},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":578,"title":579,"description":580,"published":581,"category":458,"image":582,"draft":409},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":584,"title":585,"description":586,"published":587,"category":458,"image":588,"draft":409},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":590,"title":591,"description":592,"published":593,"category":458,"image":594,"draft":409},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":596,"title":597,"description":598,"published":599,"category":458,"image":600,"draft":409},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":602,"title":603,"description":604,"published":605,"category":458,"image":606,"draft":409},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":608,"title":609,"description":610,"published":611,"category":458,"image":612,"draft":409},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":614,"title":615,"description":616,"published":617,"category":405,"image":618,"draft":409},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":620,"title":621,"description":622,"published":623,"category":405,"image":624,"draft":409},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":441,"title":5,"description":408,"published":442,"category":405,"image":429,"draft":409},{"path":627,"title":628,"description":629,"published":630,"category":458,"image":631,"draft":409},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":633,"title":634,"description":635,"published":636,"category":458,"image":637,"draft":409},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":639,"title":640,"description":641,"published":642,"category":458,"image":643,"draft":409},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":645,"title":646,"description":647,"published":648,"category":458,"image":649,"draft":409},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":651,"title":652,"description":653,"published":654,"category":458,"image":655,"draft":409},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Ten tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":657,"title":658,"description":659,"published":660,"category":458,"image":661,"draft":409},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":663,"title":664,"description":665,"published":666,"category":458,"image":667,"draft":409},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":669,"title":670,"description":671,"published":672,"category":458,"image":673,"draft":409},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":675,"title":676,"description":677,"published":678,"category":458,"image":679,"draft":409},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":681,"title":682,"description":683,"published":684,"category":458,"image":685,"draft":409},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":687,"title":688,"description":689,"published":690,"category":405,"image":691,"draft":409},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":693,"title":694,"description":695,"published":696,"category":458,"image":697,"draft":409},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":254,"title":699,"description":700,"published":701,"category":405,"image":702,"draft":409},"Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":704,"title":705,"description":706,"published":707,"category":458,"image":708,"draft":409},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":710,"title":711,"description":712,"published":713,"category":458,"image":714,"draft":409},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":716,"title":717,"description":718,"published":719,"category":458,"image":720,"draft":409},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":722,"title":723,"description":724,"published":725,"category":458,"image":726,"draft":409},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":728,"title":729,"description":730,"published":731,"category":405,"image":732,"draft":409},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":734,"title":735,"description":736,"published":737,"category":405,"image":738,"draft":409},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":740,"title":741,"description":742,"published":743,"category":458,"image":744,"draft":409},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":746,"title":747,"description":748,"published":749,"category":458,"image":750,"draft":409},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":752,"title":753,"description":754,"published":755,"category":405,"image":756,"draft":409},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":758,"title":759,"description":760,"published":761,"category":458,"image":762,"draft":409},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":764,"title":765,"description":766,"published":761,"category":458,"image":767,"draft":409},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":95,"title":769,"description":770,"published":771,"category":458,"image":772,"draft":409},"Supabase's new API keys: which one is safe in your app?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":243,"title":774,"description":775,"published":776,"category":405,"image":777,"draft":409},"Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":779,"title":780,"description":781,"published":782,"category":458,"image":783,"draft":409},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":785,"title":786,"description":787,"published":782,"category":405,"image":788,"draft":409},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":259,"title":790,"description":791,"published":792,"category":405,"image":793,"draft":409},"Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":795,"title":796,"description":797,"published":792,"category":458,"image":798,"draft":409},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1791618966336]