[{"data":1,"prerenderedAt":1384},["ShallowReactive",2],{"blog-en-supabase-relation-does-not-exist":3,"blog-index-en":858},{"id":4,"title":5,"body":6,"category":814,"cover":815,"coverAlt":816,"description":817,"draft":818,"extension":819,"faq":820,"image":836,"keywords":837,"meta":847,"navigation":848,"ogTitle":5,"path":849,"published":850,"seo":851,"stem":852,"tldr":853,"updated":850,"__hash__":857},"blog_en\u002Fblog\u002Fsupabase-relation-does-not-exist.md","Supabase \"relation does not exist\" when the table is right there",{"type":7,"value":8,"toc":801},"minimark",[9,18,28,35,38,43,61,72,75,148,181,192,196,199,208,245,302,314,317,325,336,340,353,356,403,419,425,438,443,449,453,456,464,470,484,491,494,500,517,520,526,534,539,543,549,552,558,565,580,584,596,608,611,617,624,642,647,651,654,665,674,678,681,691,714,723,741,745,794],[10,11,12,13,17],"p",{},"Your builder added an ",[14,15,16],"code",{},"invoices"," table. You can see it in the Table Editor, rows\nand all, and the page that should list them stays empty. The browser console\nshows this:",[19,20,25],"pre",{"className":21,"code":23,"language":24},[22],"language-text","{\n  \"code\": \"PGRST205\",\n  \"details\": null,\n  \"hint\": \"Perhaps you meant the table 'public.Invoices'\",\n  \"message\": \"Could not find the table 'public.invoices' in the schema cache\"\n}\n","text",[14,26,23],{"__ignoreMap":27},"",[10,29,30,31,34],{},"Supabase \"relation does not exist\" means Postgres found no table or view with\nthat exact name in the schemas the query searched. PGRST205 is the same answer\nfrom PostgREST, the part of Supabase that turns your app's ",[14,32,33],{},"supabase.from(...)","\ncalls into database queries, given before the query reaches Postgres at all.",[10,36,37],{},"The fix passed around for this error is to add the schema to Exposed schemas in\nthe project settings. That fixes one of the four causes below. It also lets\nanyone holding your app's public key reach every table in that schema, so read\nwhat it opens before you switch it on.",[39,40,42],"h2",{"id":41},"what-does-relation-does-not-exist-mean-in-supabase","What does \"relation does not exist\" mean in Supabase?",[10,44,45,46,49,50,57,60],{},"It means the database looked for a table by that exact name, on the schemas it\nwas told to search, and found none. \"Relation\" is Postgres's word for anything\nrows come out of, a table or a view. The error's code is ",[14,47,48],{},"42P01",", which\n",[51,52,56],"a",{"href":53,"rel":54},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Futils\u002Ferrcodes.txt",[55],"nofollow","Postgres names",[14,58,59],{},"undefined_table",".",[10,62,63,64,67,68,71],{},"Think of your database as a building. Each schema is a floor: ",[14,65,66],{},"public"," is the\nground floor, and ",[14,69,70],{},"auth",", where Supabase keeps your users, is another. Each\ntable is a room with its name on the door. A query that gives only a room's name\nis looked for on the floors listed in its search path. Your app's requests ride\na lift, and the lift stops only at the floors your project exposes. The error\nmeans nobody found a door with that name on the floors they checked.",[10,73,74],{},"Which wording you see depends on where the query ran:",[76,77,78,91],"table",{},[79,80,81],"thead",{},[82,83,84,88],"tr",{},[85,86,87],"th",{},"Where the query ran",[85,89,90],{},"What comes back",[92,93,94,108,122,134],"tbody",{},[82,95,96,100],{},[97,98,99],"td",{},"The SQL Editor, a migration, a function or a trigger",[97,101,102,105,106],{},[14,103,104],{},"relation \"invoices\" does not exist",", code ",[14,107,48],{},[82,109,110,113],{},[97,111,112],{},"Your app, on PostgREST 13 or later",[97,114,115,105,118,121],{},[14,116,117],{},"Could not find the table 'public.invoices' in the schema cache",[14,119,120],{},"PGRST205",", HTTP 404",[82,123,124,127],{},[97,125,126],{},"Your app, on an older PostgREST",[97,128,129,130,133],{},"a read gets ",[14,131,132],{},"relation \"public.invoices\" does not exist",", HTTP 404, and an insert gets an empty error",[82,135,136,139],{},[97,137,138],{},"Your app, asking for a schema the project does not expose",[97,140,141,105,144,147],{},[14,142,143],{},"Invalid schema: billing",[14,145,146],{},"PGRST106",", HTTP 406",[10,149,150,151,156,157,159,160,165,166,168,169,174,175,180],{},"PostgREST's ",[51,152,155],{"href":153,"rel":154},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fblob\u002Fmain\u002FCHANGELOG.md",[55],"changelog","\ndates the newer wording to version 13.0.0, released on 8 May 2025: \"Querying\nnon-existent table now returns ",[14,158,120],{}," error\". Before that, as one of its\nmaintainers ",[51,161,164],{"href":162,"rel":163},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fissues\u002F3697",[55],"explained on issue #3697",",\na read went to Postgres unchecked and came back as ",[14,167,48],{},". Supabase's\n",[51,170,173],{"href":171,"rel":172},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fhardening-data-api",[55],"guide to securing the Data API","\nsays you can check your project's PostgREST version in the Dashboard.\n",[51,176,179],{"href":177,"rel":178},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fblob\u002Fmain\u002Fsrc\u002Flibrary\u002FPostgREST\u002FError.hs",[55],"PostgREST's own code","\nfixes the rest: PGRST205's hint, when there is one, names the closest table it\nknows on the same floor.",[10,182,183,184,187,188,60],{},"If the message says ",[14,185,186],{},"permission denied for table"," instead, the table was found\nand your app was refused at the door. That one has\n",[51,189,191],{"href":190},"\u002Fblog\u002Fsupabase-permission-denied-for-table","a different fix",[39,193,195],{"id":194},"cause-1-the-name-on-the-door-has-a-capital-letter","Cause 1: the name on the door has a capital letter",[10,197,198],{},"The name has to match exactly, capitals included, and two of the tools you use\ntreat capitals differently from the third.",[10,200,201,202,207],{},"Postgres's\n",[51,203,206],{"href":204,"rel":205},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fsql-syntax-lexical.html",[55],"documentation","\nputs the rule in one sentence: \"Quoting an identifier also makes it\ncase-sensitive, whereas unquoted names are always folded to lower case.\" The\nother two keep what you typed:",[209,210,211,227],"ul",{},[212,213,214,215,220,221,224,225,60],"li",{},"Supabase's Table Editor creates a table under exactly the name you give it.\n",[51,216,219],{"href":217,"rel":218},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase\u002Fblob\u002Fmaster\u002Fpackages\u002Fpg-meta\u002Fsrc\u002Fpg-meta-tables.ts",[55],"Its code","\nputs the name in quotes when it needs them, so ",[14,222,223],{},"Invoices"," stays ",[14,226,223],{},[212,228,229,230,237,238,241,242,244],{},"PostgREST wraps every name your app sends in double quotes\n(",[51,231,234],{"href":232,"rel":233},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fblob\u002Fmain\u002Fsrc\u002Flibrary\u002FPostgREST\u002FQuery\u002FSqlFragment.hs",[55],[14,235,236],{},"pgFmtIdent","),\nso ",[14,239,240],{},".from('invoices')"," asks for ",[14,243,16],{}," and for nothing else.",[76,246,247,260],{},[79,248,249],{},[82,250,251,254,257],{},[85,252,253],{},"How the table was made",[85,255,256],{},"In SQL, write",[85,258,259],{},"In your app, write",[92,261,262,281],{},[82,263,264,273,277],{},[97,265,266,269,270,272],{},[14,267,268],{},"create table invoices",", or ",[14,271,223],{}," typed in SQL without quotes",[97,274,275],{},[14,276,16],{},[97,278,279],{},[14,280,240],{},[82,282,283,291,297],{},[97,284,285,269,288,290],{},[14,286,287],{},"create table \"Invoices\"",[14,289,223],{}," typed in the Table Editor",[97,292,293,296],{},[14,294,295],{},"\"Invoices\"",", quotes included",[97,298,299],{},[14,300,301],{},".from('Invoices')",[10,303,304,305,307,308,310,311,313],{},"The second row produces this error from both sides. Your app calls\n",[14,306,240],{}," and gets PGRST205, with the real name in the hint, as in the\nmessage at the top of this page. Or the app works, and a function or a policy\nthat names ",[14,309,223],{}," without quotes fails with ",[14,312,104],{},", because Postgres folded the name before it went looking.",[10,315,316],{},"To see every table with that name, on any floor and in any capitals, run this in\nthe SQL Editor:",[19,318,323],{"className":319,"code":321,"language":322,"meta":27},[320],"language-sql","select table_schema, table_name\nfrom information_schema.tables\nwhere table_name ilike 'invoices';\n","sql",[14,324,321],{"__ignoreMap":27},[10,326,327,328,330,331,335],{},"The fix that touches nothing in your data is in the code: write ",[14,329,295],{},"\nwith its quotes in SQL, and the exact capitals in the app. Renaming the table\ninstead breaks every screen still using the old name.\n",[51,332,334],{"href":333},"\u002Fblog\u002Fsupabase-schema-cache-column-error","The column version of this error"," has\nthe same trap for column names.",[39,337,339],{"id":338},"cause-2-the-table-is-on-another-floor","Cause 2: the table is on another floor",[10,341,342,343,345,346,349,350,352],{},"Your app looks in ",[14,344,66],{}," unless it is told otherwise, so a table in any other\nschema is missing as far as it can tell. That is why the message says\n",[14,347,348],{},"public.invoices",": ",[14,351,66],{}," is the floor the lift went to.",[10,354,355],{},"It happens in three ways:",[209,357,358,371,380],{},[212,359,360,361,364,365,368,369],{},"your builder created the table in a schema of its own, such as ",[14,362,363],{},"billing"," or\n",[14,366,367],{},"private",", and the app calls a plain ",[14,370,240],{},[212,372,373,374,377,378],{},"the schema is written into the name, as ",[14,375,376],{},".from('billing.invoices')",".\nPostgREST reads the whole string as one table name and looks for it in\n",[14,379,66],{},[212,381,382,383,168,386,391,392,394,395,398,399],{},"the table is ",[14,384,385],{},"auth.users",[51,387,390],{"href":388,"rel":389},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fmanaging-user-data",[55],"guide to user data","\nsays: \"For security, the Auth schema is not exposed in the auto-generated API.\"\nIts answer is a table of your own in ",[14,393,66],{},", ",[14,396,397],{},"profiles"," in its example,\nfilled in by a trigger when someone signs up, and\n",[51,400,402],{"href":401},"\u002Fblog\u002Fdatabase-error-saving-new-user","that trigger can fail in ways of its own",[10,404,405,406,409,410,415,416,418],{},"A table on another floor is read with ",[14,407,408],{},".schema('billing').from('invoices')",", and\nthat schema has to be listed under Exposed schemas in the project's API\nsettings, as\n",[51,411,414],{"href":412,"rel":413},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fapi\u002Fusing-custom-schemas",[55],"Supabase's guide to custom schemas","\nshows. Until it is, the answer changes to ",[14,417,146],{},":",[19,420,423],{"className":421,"code":422,"language":24},[22],"{\n  \"code\": \"PGRST106\",\n  \"details\": null,\n  \"hint\": \"Only the following schemas are exposed: public, graphql_public\",\n  \"message\": \"Invalid schema: billing\"\n}\n",[14,424,422],{"__ignoreMap":27},[10,426,427,428,431,432,437],{},"The hint lists the floors the lift does stop at. PostgREST 12 words the same\nerror differently, with the list in the message itself:\n",[14,429,430],{},"The schema must be one of the following: public, graphql_public",". That is the\ntext ",[51,433,436],{"href":434,"rel":435},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fblob\u002Fv12.2.12\u002Fsrc\u002FPostgREST\u002FError.hs",[55],"its code for that version","\nproduces, and the changelog moved the schema name into the message in 13.0.7.",[10,439,440,441,60],{},"Your secret key rides the same lift. Exposure is a setting of the API, so server\ncode using supabase-js with that key gets the same ",[14,442,146],{},[444,445],"diagram",{"alt":446,"caption":447,"src":448},"A building in cross-section with three floors, public at the bottom, billing in the middle and auth at the top, and a lift shaft on the right. The lift stops at public, where the invoices door is a dashed empty slot leading to a plate reading PGRST205 and 404. Its stop at billing, where the invoices door stands, is a dashed amber gap leading to a plate reading PGRST106 and 406. The auth floor has no stop at all.","The lift stops only at exposed floors. A table on another floor is missing from public, and asking for that floor by name is refused until it is exposed.","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fthe-lift-stops-at-public-1600x760.png",[39,450,452],{"id":451},"what-does-exposing-a-schema-open","What does exposing a schema open?",[10,454,455],{},"It makes the lift stop at that floor, and with the grants Supabase's guide gives,\nit hands every visitor a key to every room there. Row Level Security is then the\nonly thing deciding what each of them can read or change.",[10,457,458,459,463],{},"The ",[51,460,462],{"href":412,"rel":461},[55],"guide to custom schemas","\nhas two steps. The first is the Exposed schemas setting. The second is a block of\nSQL, and its first two lines are:",[19,465,468],{"className":466,"code":467,"language":322,"meta":27},[320],"GRANT USAGE ON SCHEMA myschema TO anon, authenticated, service_role;\nGRANT ALL ON ALL TABLES IN SCHEMA myschema TO anon, authenticated, service_role;\n",[14,469,467],{"__ignoreMap":27},[10,471,472,475,476,479,480,483],{},[14,473,474],{},"anon"," is the role behind every request from someone who has not signed in.\n",[14,477,478],{},"ALL"," is read, add, change and delete. The block goes on with\n",[14,481,482],{},"ALTER DEFAULT PRIVILEGES",", which hands the same access to every table created on\nthat floor later.",[10,485,486,487,490],{},"That is safe where Row Level Security, the per-row rules Supabase checks on every\nrequest, is on and written for each table. Supabase's\n",[51,488,173],{"href":171,"rel":489},[55],"\nsays: \"Tables created through the Supabase Dashboard have RLS enabled by default.\nEnable RLS explicitly for tables created in the SQL Editor or through another\ntool.\" A schema your builder set up in SQL may hold tables with it off. Exposed\nwith those grants, a table like that hands every row to anyone who has your\npublic key, and accepts their changes too.",[10,492,493],{},"Check before you expose:",[19,495,498],{"className":496,"code":497,"language":322,"meta":27},[320],"select tablename, rowsecurity\nfrom pg_tables\nwhere schemaname = 'billing';\n",[14,499,497],{"__ignoreMap":27},[10,501,502,503,506,507,511,512,516],{},"Every row that says ",[14,504,505],{},"false"," is a table with no rules at all.\n",[51,508,510],{"href":509},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Turning Row Level Security on for every table","\ncovers switching it on and writing the first rule, and\n",[51,513,515],{"href":514},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","\"RLS disabled in public\""," covers the open\nread rule that leaves a table just as reachable with it on.",[10,518,519],{},"You can also grant less than the guide does. A floor with one table that only\nsigned-in users read needs two lines:",[19,521,524],{"className":522,"code":523,"language":322,"meta":27},[320],"grant usage on schema billing to authenticated;\ngrant select on billing.invoices to authenticated;\n",[14,525,523],{"__ignoreMap":27},[10,527,528,529,533],{},"Whether your tables answer a stranger is something you can check from outside.\nOur ",[51,530,532],{"href":531},"\u002Fsecurity-scanner","free scan"," reads your live app with the same public key a\nvisitor gets, reports which tables hand back rows, and needs no account.",[444,535],{"alt":536,"caption":537,"src":538},"The billing floor drawn twice. On the left the lift has no stop there and three doors are shut. On the right the lift stops there and all three doors stand open: two rooms carry a padlock over their rows, and the third has none and its rows are amber.","Exposing a floor with the guide's grants opens every door on it. Row Level Security is the padlock inside each room, and a room without one is open to anyone with your public key.","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fexposing-opens-every-room-1600x700.png",[39,540,542],{"id":541},"should-you-expose-the-schema-or-move-the-table","Should you expose the schema or move the table?",[10,544,545,546,548],{},"Decide by who reads the table. A table your app reads from the browser needs a\ngrant for the role reading it and Row Level Security with a rule, wherever it\nsits, so moving it to ",[14,547,66],{}," saves you the exposure step and nothing else.",[10,550,551],{},"If you do move it:",[19,553,556],{"className":554,"code":555,"language":322,"meta":27},[320],"alter table billing.invoices set schema public;\n",[14,557,555],{"__ignoreMap":27},[10,559,560,561,564],{},"The table keeps its grants and its rules. A function whose body names\n",[14,562,563],{},"billing.invoices"," then fails with this same error, because the body keeps the\nname as it was written.",[10,566,567,568,570,571,575,576,579],{},"A table only server code needs can stay on a floor the lift never visits. A\nfunction in ",[14,569,66],{}," can do the one job your app needs with it, and\n",[51,572,574],{"href":573},"\u002Fblog\u002Fsupabase-function-not-found","calling a Supabase function"," covers taking\n",[14,577,578],{},"execute"," away from visitors who are not signed in.",[39,581,583],{"id":582},"cause-3-a-function-with-an-empty-search-path","Cause 3: a function with an empty search path",[10,585,586,587,590,591,593,594,60],{},"A function set to ",[14,588,589],{},"search_path = ''"," searches no floor at all, so every table\ninside it needs its schema written in front: ",[14,592,348],{},", never a bare\n",[14,595,16],{},[10,597,598,599,607],{},"Supabase's Security Advisor asks for that setting. Its\n",[51,600,603,604],{"href":601,"rel":602},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsplinter\u002Fblob\u002Fmain\u002Fdocs\u002F0011_function_search_path_mutable.md",[55],"warning ",[14,605,606],{},"function_search_path_mutable","\nsays: \"We recommend pinning functions' search_path to an empty string\". The same\npage ends: \"once you set the search_path = '' all references to\ntables\u002Ffunctions\u002Fviews\u002Fetc in your function's body must be qualified with a\nschema name.\"",[10,609,610],{},"So the warning is fixed by adding one line, and the function then fails on its\nfirst bare table name:",[19,612,615],{"className":613,"code":614,"language":322,"meta":27},[320],"create or replace function public.count_invoices()\nreturns bigint\nlanguage plpgsql\nset search_path = ''\nas $$\nbegin\n  return (select count(*) from invoices);  -- relation \"invoices\" does not exist\nend;\n$$;\n",[14,616,614],{"__ignoreMap":27},[10,618,619,620,623],{},"Write ",[14,621,622],{},"from public.invoices"," and it works again. Keep the setting: it is there so\nthat whoever calls the function cannot point a bare name at a table of their own.",[10,625,626,627,630,631,633,634,638,639,60],{},"Called from your app with ",[14,628,629],{},".rpc()",", the error passes through PostgREST as ",[14,632,48],{},"\nwith HTTP 404, the status\n",[51,635,637],{"href":177,"rel":636},[55],"PostgREST's code","\ngives an undefined table. A trigger on new sign-ups that fails this way shows up\nas ",[51,640,641],{"href":401},"\"Database error saving new user\"",[444,643],{"alt":644,"caption":645,"src":646},"Two lookups from inside a function marked search_path = ''. The upper one asks for invoices with no floor, finds an empty list of floors to search, and ends at a plate reading 42P01. The lower one asks for public.invoices, goes straight to the invoices door on the public floor, and is ticked.","With an empty search path there is no floor to search, so only a full address finds the room.","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fan-empty-search-path-1600x620.png",[39,648,650],{"id":649},"cause-4-the-table-is-not-in-that-project-yet","Cause 4: the table is not in that project yet",[10,652,653],{},"The table exists in another database, or only in your code.",[10,655,656,657,661,662,664],{},"One Supabase account can hold several projects, and\n",[51,658,660],{"href":659},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","a branch is a separate project"," with\nits own database. A table created in the SQL Editor of the wrong one is a room in\na different building. ",[51,663,334],{"href":333},"\nshows how to compare the project reference in your app's Supabase address with\nthe one in the dashboard.",[10,666,667,668,673],{},"If you build with Lovable, look back through the chat for SQL you were asked to\napprove. Lovable's ",[51,669,672],{"href":670,"rel":671},"https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fsupabase",[55],"Supabase documentation","\nsays it \"writes the SQL, shows it to you, and asks for your approval in the\nproject chat before running it\". Until you approve it, the table exists only in\nthe code that reads it.",[39,675,677],{"id":676},"moving-a-table-your-app-depends-on","Moving a table your app depends on",[10,679,680],{},"Keep a copy of the database from before the move, and hear about it when\nsomething your app exposes changes.",[10,682,683],{},[684,685,686,690],"strong",{},[51,687,689],{"href":688},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database:",[209,692,693,696,702,705,708,711],{},[212,694,695],{},"an encrypted copy on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[212,697,698,699,701],{},"every schema you made, ",[14,700,66],{}," and the others, with their tables and rows as they were before your change",[212,703,704],{},"each copy verified before it counts, by counting the rows in every table",[212,706,707],{},"your uploaded files as well, once you connect a Storage credential",[212,709,710],{},"a one-click restore, with a safety copy of the current state taken first",[212,712,713],{},"everything Monitor does",[10,715,716],{},[684,717,718,722],{},[51,719,721],{"href":720},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking from outside:",[209,724,725,728,731,738],{},[212,726,727],{},"whether your app is up, checked every minute",[212,729,730],{},"the full security check every hour, on up to three apps",[212,732,733,734,737],{},"a message when a result ",[684,735,736],{},"changes",", so a deploy that changes what your app exposes reaches you without you going to look",[212,739,740],{},"a monthly report, in plain language, of what it saw",[39,742,744],{"id":743},"what-to-do-now","What to do now",[746,747,748],"key-takeaways",{},[209,749,750,757,760,773,782,791],{},[212,751,752,753,756],{},"Read the message: the name in quotes is what was asked for, and ",[14,754,755],{},"public."," in front of it is the schema that was searched.",[212,758,759],{},"Compare the name with the Table Editor, capitals included. A table with a capital in its name needs double quotes in SQL.",[212,761,762,763,766,767,769,770,60],{},"Find which schema the table is in with the ",[14,764,765],{},"information_schema.tables"," query, and call a table outside ",[14,768,66],{}," with ",[14,771,772],{},".schema('name').from(...)",[212,774,775,776,779,780,60],{},"Before you expose a schema, run the ",[14,777,778],{},"pg_tables"," query and switch Row Level Security on for every table that says ",[14,781,505],{},[212,783,784,785,787,788,60],{},"Inside a function with ",[14,786,589],{},", write every table as ",[14,789,790],{},"public.name",[212,792,793],{},"Check that the project your app calls is the one where you made the table.",[10,795,796,797,800],{},"Start with the two names in the message, the table and the schema in front of it,\nbecause they say exactly which door was asked for and on which floor. Before you\nmove, rename or expose anything people use,\n",[51,798,799],{"href":688},"keep a copy of the database"," from before the change.",{"title":27,"searchDepth":802,"depth":802,"links":803},3,[804,806,807,808,809,810,811,812,813],{"id":41,"depth":805,"text":42},2,{"id":194,"depth":805,"text":195},{"id":338,"depth":805,"text":339},{"id":451,"depth":805,"text":452},{"id":541,"depth":805,"text":542},{"id":582,"depth":805,"text":583},{"id":649,"depth":805,"text":650},{"id":676,"depth":805,"text":677},{"id":743,"depth":805,"text":744},"Security basics","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcover-1200x630.png","A building in cross-section beside a lift shaft. The lift stands at the ground floor, and its stop one floor up is a dashed amber gap.","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.",false,"md",[821,824,827,830,833],{"q":822,"a":823},"Why does Supabase say my table does not exist?","Because no table with that exact name sits in the schema the query searched. Check four things in order: the capitals in the name, the schema the table is in (your app looks in public unless told otherwise), the project your app talks to, and whether the query runs inside a function set to an empty search_path, where every table needs its schema written in front.",{"q":825,"a":826},"What does \"the schema must be one of the following\" mean?","It is error PGRST106 in the wording older PostgREST versions use. Your app asked for a schema the project does not expose, for example through .schema('name'), and the list after it is the schemas that are exposed. Newer versions say \"Invalid schema: name\" and put the same list in the hint. Exposing the schema fixes it, and it is worth deciding on purpose.",{"q":828,"a":829},"Is it safe to expose a schema in Supabase?","Only once every table in it has Row Level Security switched on and a rule written. Supabase's guide to custom schemas grants anon, the role of every visitor who is not signed in, full access to every table in the schema, including tables made there later. Its security guide adds that tables created in the SQL Editor do not get Row Level Security by default.",{"q":831,"a":832},"Does table name capitalisation matter in Supabase?","Yes. A name typed in SQL without double quotes is folded to lower case, while the Table Editor and supabase-js keep the capitals exactly as written. A table created as Invoices has to be written \"Invoices\", in quotes, in SQL, and .from('Invoices') in your app.",{"q":834,"a":835},"Should I move the table to public instead?","Moving it fixes the schema half of the error and none of the safety half: a table your app reads from the browser needs a grant for the role reading it and Row Level Security with a rule, wherever it sits. A table only server code needs can stay in a schema that is not exposed, reached through a function in public that does the one job your app needs.","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",[838,839,840,841,842,843,844,845,846],"relation does not exist supabase","supabase relation does not exist","could not find the table in the schema cache","pgrst205","42p01","the schema must be one of the following","pgrst106","supabase schema not exposed","supabase table not found api",{},true,"\u002Fblog\u002Fsupabase-relation-does-not-exist","2026-10-23",{"title":5,"description":817},"blog\u002Fsupabase-relation-does-not-exist",[854,855,856],"Supabase \"relation does not exist\" (Postgres code 42P01) means no table or view with that exact name sits in the schemas the query searched. From your app on a current project, the same problem reads \"Could not find the table in the schema cache\" (PGRST205).","Check the name letter for letter first, capitals included, then the schema, then the project. Inside a function set to an empty search_path, every table needs its schema written in front: public.invoices.","Exposing a schema makes the error go away and lets the API reach every table in it, so check Row Level Security on each of those tables before you do.","gjdVrg1ERJynPKQUSjPYFAPiopW2l4RL69rXDt7_iU4",[859,865,871,877,883,889,895,901,907,913,919,926,932,938,944,950,956,962,963,968,973,979,985,991,997,1003,1009,1014,1020,1026,1032,1038,1044,1050,1056,1062,1068,1074,1080,1086,1092,1098,1104,1110,1116,1122,1126,1132,1138,1144,1150,1156,1162,1168,1174,1180,1186,1192,1198,1204,1210,1216,1221,1226,1232,1238,1244,1250,1256,1262,1268,1274,1280,1286,1292,1298,1304,1310,1315,1321,1327,1333,1339,1345,1350,1356,1362,1368,1373,1379],{"path":860,"title":861,"description":862,"published":863,"category":814,"image":864,"draft":818},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":866,"title":867,"description":868,"published":869,"category":814,"image":870,"draft":818},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":872,"title":873,"description":874,"published":875,"category":814,"image":876,"draft":818},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":878,"title":879,"description":880,"published":881,"category":814,"image":882,"draft":818},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":884,"title":885,"description":886,"published":887,"category":814,"image":888,"draft":818},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":890,"title":891,"description":892,"published":893,"category":814,"image":894,"draft":818},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":896,"title":897,"description":898,"published":899,"category":814,"image":900,"draft":818},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":902,"title":903,"description":904,"published":905,"category":814,"image":906,"draft":818},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":908,"title":909,"description":910,"published":911,"category":814,"image":912,"draft":818},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":914,"title":915,"description":916,"published":917,"category":814,"image":918,"draft":818},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":920,"title":921,"description":922,"published":923,"category":924,"image":925,"draft":818},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":927,"title":928,"description":929,"published":930,"category":814,"image":931,"draft":818},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":933,"title":934,"description":935,"published":936,"category":814,"image":937,"draft":818},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":939,"title":940,"description":941,"published":942,"category":814,"image":943,"draft":818},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":945,"title":946,"description":947,"published":948,"category":814,"image":949,"draft":818},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":951,"title":952,"description":953,"published":954,"category":814,"image":955,"draft":818},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":957,"title":958,"description":959,"published":960,"category":814,"image":961,"draft":818},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":849,"title":5,"description":817,"published":850,"category":814,"image":836,"draft":818},{"path":573,"title":964,"description":965,"published":966,"category":814,"image":967,"draft":818},"Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":333,"title":969,"description":970,"published":971,"category":814,"image":972,"draft":818},"Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":974,"title":975,"description":976,"published":977,"category":814,"image":978,"draft":818},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":980,"title":981,"description":982,"published":983,"category":814,"image":984,"draft":818},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":986,"title":987,"description":988,"published":989,"category":814,"image":990,"draft":818},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":992,"title":993,"description":994,"published":995,"category":814,"image":996,"draft":818},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":998,"title":999,"description":1000,"published":1001,"category":814,"image":1002,"draft":818},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":1004,"title":1005,"description":1006,"published":1007,"category":814,"image":1008,"draft":818},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":401,"title":1010,"description":1011,"published":1012,"category":814,"image":1013,"draft":818},"\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":1015,"title":1016,"description":1017,"published":1018,"category":814,"image":1019,"draft":818},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":1021,"title":1022,"description":1023,"published":1024,"category":814,"image":1025,"draft":818},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1027,"title":1028,"description":1029,"published":1030,"category":814,"image":1031,"draft":818},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":1033,"title":1034,"description":1035,"published":1036,"category":814,"image":1037,"draft":818},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":1039,"title":1040,"description":1041,"published":1042,"category":814,"image":1043,"draft":818},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":1045,"title":1046,"description":1047,"published":1048,"category":814,"image":1049,"draft":818},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":1051,"title":1052,"description":1053,"published":1054,"category":814,"image":1055,"draft":818},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":1057,"title":1058,"description":1059,"published":1060,"category":814,"image":1061,"draft":818},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":1063,"title":1064,"description":1065,"published":1066,"category":814,"image":1067,"draft":818},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":1069,"title":1070,"description":1071,"published":1072,"category":814,"image":1073,"draft":818},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":1075,"title":1076,"description":1077,"published":1078,"category":814,"image":1079,"draft":818},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":1081,"title":1082,"description":1083,"published":1084,"category":814,"image":1085,"draft":818},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":1087,"title":1088,"description":1089,"published":1090,"category":814,"image":1091,"draft":818},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":1093,"title":1094,"description":1095,"published":1096,"category":814,"image":1097,"draft":818},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":1099,"title":1100,"description":1101,"published":1102,"category":814,"image":1103,"draft":818},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":1105,"title":1106,"description":1107,"published":1108,"category":924,"image":1109,"draft":818},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":1111,"title":1112,"description":1113,"published":1114,"category":924,"image":1115,"draft":818},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":1117,"title":1118,"description":1119,"published":1120,"category":924,"image":1121,"draft":818},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":190,"title":1123,"description":1124,"published":1120,"category":814,"image":1125,"draft":818},"Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":1127,"title":1128,"description":1129,"published":1130,"category":814,"image":1131,"draft":818},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":1133,"title":1134,"description":1135,"published":1136,"category":814,"image":1137,"draft":818},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":1139,"title":1140,"description":1141,"published":1142,"category":924,"image":1143,"draft":818},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":1145,"title":1146,"description":1147,"published":1148,"category":814,"image":1149,"draft":818},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":1151,"title":1152,"description":1153,"published":1154,"category":814,"image":1155,"draft":818},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":1157,"title":1158,"description":1159,"published":1160,"category":814,"image":1161,"draft":818},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":1163,"title":1164,"description":1165,"published":1166,"category":814,"image":1167,"draft":818},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":1169,"title":1170,"description":1171,"published":1172,"category":814,"image":1173,"draft":818},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":1175,"title":1176,"description":1177,"published":1178,"category":814,"image":1179,"draft":818},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1181,"title":1182,"description":1183,"published":1184,"category":814,"image":1185,"draft":818},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1187,"title":1188,"description":1189,"published":1190,"category":814,"image":1191,"draft":818},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1193,"title":1194,"description":1195,"published":1196,"category":924,"image":1197,"draft":818},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1199,"title":1200,"description":1201,"published":1202,"category":924,"image":1203,"draft":818},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1205,"title":1206,"description":1207,"published":1208,"category":924,"image":1209,"draft":818},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1211,"title":1212,"description":1213,"published":1214,"category":814,"image":1215,"draft":818},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":509,"title":1217,"description":1218,"published":1219,"category":814,"image":1220,"draft":818},"Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":514,"title":1222,"description":1223,"published":1224,"category":814,"image":1225,"draft":818},"Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1227,"title":1228,"description":1229,"published":1230,"category":814,"image":1231,"draft":818},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1233,"title":1234,"description":1235,"published":1236,"category":814,"image":1237,"draft":818},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1239,"title":1240,"description":1241,"published":1242,"category":814,"image":1243,"draft":818},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1245,"title":1246,"description":1247,"published":1248,"category":814,"image":1249,"draft":818},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1251,"title":1252,"description":1253,"published":1254,"category":814,"image":1255,"draft":818},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1257,"title":1258,"description":1259,"published":1260,"category":814,"image":1261,"draft":818},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1263,"title":1264,"description":1265,"published":1266,"category":814,"image":1267,"draft":818},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1269,"title":1270,"description":1271,"published":1272,"category":924,"image":1273,"draft":818},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1275,"title":1276,"description":1277,"published":1278,"category":814,"image":1279,"draft":818},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1281,"title":1282,"description":1283,"published":1284,"category":924,"image":1285,"draft":818},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1287,"title":1288,"description":1289,"published":1290,"category":814,"image":1291,"draft":818},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1293,"title":1294,"description":1295,"published":1296,"category":814,"image":1297,"draft":818},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1299,"title":1300,"description":1301,"published":1302,"category":814,"image":1303,"draft":818},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1305,"title":1306,"description":1307,"published":1308,"category":814,"image":1309,"draft":818},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":659,"title":1311,"description":1312,"published":1313,"category":924,"image":1314,"draft":818},"Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1316,"title":1317,"description":1318,"published":1319,"category":924,"image":1320,"draft":818},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1322,"title":1323,"description":1324,"published":1325,"category":814,"image":1326,"draft":818},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1328,"title":1329,"description":1330,"published":1331,"category":814,"image":1332,"draft":818},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1334,"title":1335,"description":1336,"published":1337,"category":924,"image":1338,"draft":818},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1340,"title":1341,"description":1342,"published":1343,"category":814,"image":1344,"draft":818},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1346,"title":1347,"description":1348,"published":1343,"category":814,"image":1349,"draft":818},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1351,"title":1352,"description":1353,"published":1354,"category":814,"image":1355,"draft":818},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1357,"title":1358,"description":1359,"published":1360,"category":924,"image":1361,"draft":818},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1363,"title":1364,"description":1365,"published":1366,"category":814,"image":1367,"draft":818},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1369,"title":1370,"description":1371,"published":1366,"category":924,"image":1372,"draft":818},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1374,"title":1375,"description":1376,"published":1377,"category":924,"image":1378,"draft":818},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1380,"title":1381,"description":1382,"published":1377,"category":814,"image":1383,"draft":818},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]