[{"data":1,"prerenderedAt":1235},["ShallowReactive",2],{"blog-en-supabase-schema-cache-column-error":3,"blog-index-en":707},{"id":4,"title":5,"body":6,"category":665,"cover":666,"coverAlt":667,"description":668,"draft":669,"extension":670,"faq":671,"image":686,"keywords":687,"meta":696,"navigation":697,"ogTitle":5,"path":698,"published":699,"seo":700,"stem":701,"tldr":702,"updated":699,"__hash__":706},"blog_en\u002Fblog\u002Fsupabase-schema-cache-column-error.md","Supabase PGRST204: \"Could not find the column in the schema cache\"",{"type":7,"value":8,"toc":651},"minimark",[9,13,24,31,39,44,47,50,73,114,117,123,127,139,148,157,225,237,240,248,255,263,272,276,279,282,288,311,314,338,358,363,367,375,384,400,404,425,438,443,447,450,456,471,474,480,483,487,490,498,501,513,517,520,528,534,548,552,555,562,582,591,609,613,644],[10,11,12],"p",{},"You asked your builder to add a phone number to the profile form. The column is\nthere in the Table Editor. You press Save, nothing happens, and the browser\nconsole shows this:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","{\n  \"code\": \"PGRST204\",\n  \"details\": null,\n  \"hint\": null,\n  \"message\": \"Could not find the 'phoneNumber' column of 'profiles' in the schema cache\"\n}\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26,27,30],{},"Supabase \"Could not find the column in the schema cache\" means your app tried\nto save a field that the table, as PostgREST sees it, does not have. PostgREST\nis the part of Supabase that turns your app's ",[21,28,29],{},"supabase.from(...)"," calls into\ndatabase queries. It keeps its own list of every table and every column, called\nthe schema cache, so it does not have to ask the database about its shape on\neach request.",[10,32,33,34,38],{},"Here is the part most answers get wrong: ",[35,36,37],"strong",{},"they tell you to reload the schema\ncache."," On Supabase the cache reloads itself every time a table changes. So if\nyou have just added a column and you still see this error, the cache is the\nleast likely reason. The name usually is.",[40,41,43],"h2",{"id":42},"what-does-could-not-find-the-column-in-the-schema-cache-mean","What does \"Could not find the column in the schema cache\" mean?",[10,45,46],{},"It means one key in a write your app sent has no matching column in that table.",[10,48,49],{},"Think of the schema cache as the directory board in a building's lobby: a line\nfor every office, which is a table, and under it every room, which is a column.\nEach request your app sends is a delivery slip. PostgREST reads every line of\nthe slip against the board, and a room the board does not list is refused at\nthe front desk, before anything reaches your data.",[10,51,52,53,56,57,60,61,64,65,72],{},"The message names both sides of that comparison. In ",[21,54,55],{},"Could not find the 'phoneNumber' column of 'profiles' in the schema cache",", ",[21,58,59],{},"phoneNumber"," is what\nyour app sent and ",[21,62,63],{},"profiles"," is the table it went to. Three more things are\nfixed in\n",[66,67,71],"a",{"href":68,"rel":69},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fblob\u002Fmain\u002Fsrc\u002Flibrary\u002FPostgREST\u002FError.hs",[70],"nofollow","PostgREST's own code",":",[74,75,76,84,98],"ul",{},[77,78,79,80,83],"li",{},"the code is ",[21,81,82],{},"PGRST204"," and the status is HTTP 400, which means the request\nitself was wrong",[77,85,86,87,56,90,93,94,97],{},"it comes from writes only: ",[21,88,89],{},".insert()",[21,91,92],{},".update()"," and ",[21,95,96],{},".upsert()",". A read\nthat names a missing column fails with a different error, written by Postgres",[77,99,100,101,105,106,109,110,113],{},"it carries no hint. For\n",[66,102,104],{"href":103},"\u002Fblog\u002Fsupabase-relation-does-not-exist","a missing table"," PostgREST suggests\nthe nearest name it knows; for a missing column ",[21,107,108],{},"hint"," is ",[21,111,112],{},"null",", and the comparison is yours",[10,115,116],{},"Every key in the object you pass to one of those three calls has to be a column\nof that table, spelled the way the table spells it.",[118,119],"diagram",{"alt":120,"caption":121,"src":122},"A delivery slip with three lines beside the profiles board, which lists four rooms. Two lines on the slip connect to rooms with the same name and are ticked. The third line, phoneNumber, ends in amber at a not-equal sign beside phone_number.","PostgREST compares each key your app sends with the columns it has listed, letter for letter. phoneNumber and phone_number are two different names.","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fletter-for-letter-1600x700.png",[40,124,126],{"id":125},"cause-1-the-name-does-not-match-letter-for-letter","Cause 1: the name does not match, letter for letter",[10,128,129,130,56,132,93,135,138],{},"The check is exact. To PostgREST ",[21,131,59],{},[21,133,134],{},"phone_number",[21,136,137],{},"phonenumber","\nare three different columns, and your table has at most one of them.",[10,140,141,142,144,145,147],{},"There are two common ways to end up here. The first is two naming habits\nmeeting: JavaScript usually writes a field as ",[21,143,59],{},", and a Postgres\ncolumn is usually ",[21,146,134],{},". The code your builder wrote and the SQL it\nran can each be right on their own terms and still disagree.",[10,149,150,151,156],{},"The second is the quoting trap. In SQL, a name typed without double quotes is\nfolded to lower case. Postgres's\n",[66,152,155],{"href":153,"rel":154},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fsql-syntax-lexical.html",[70],"own documentation","\nsays it plainly: \"Quoting an identifier also makes it case-sensitive, whereas\nunquoted names are always folded to lower case.\"",[158,159,160,176],"table",{},[161,162,163],"thead",{},[164,165,166,170,173],"tr",{},[167,168,169],"th",{},"What you ran in the SQL Editor",[167,171,172],{},"The column it created",[167,174,175],{},"What your app has to send",[177,178,179,195,210],"tbody",{},[164,180,181,187,191],{},[182,183,184],"td",{},[21,185,186],{},"alter table profiles add column phone_number text;",[182,188,189],{},[21,190,134],{},[182,192,193],{},[21,194,134],{},[164,196,197,202,206],{},[182,198,199],{},[21,200,201],{},"alter table profiles add column phoneNumber text;",[182,203,204],{},[21,205,137],{},[182,207,208],{},[21,209,137],{},[164,211,212,217,221],{},[182,213,214],{},[21,215,216],{},"alter table profiles add column \"phoneNumber\" text;",[182,218,219],{},[21,220,59],{},[182,222,223],{},[21,224,59],{},[10,226,227,228,230,231,233,234,236],{},"The middle row is the one that catches people. The SQL looks like it made\n",[21,229,59],{},", the code sends ",[21,232,59],{},", and the column is ",[21,235,137],{},".",[10,238,239],{},"To see the real names, open the table in the Table Editor and read the column\nheaders, or run this in the SQL Editor:",[14,241,246],{"className":242,"code":244,"language":245,"meta":23},[243],"language-sql","select column_name\nfrom information_schema.columns\nwhere table_schema = 'public' and table_name = 'profiles';\n","sql",[21,247,244],{"__ignoreMap":23},[10,249,250,251,254],{},"Then look at what your app sent. In your browser's developer tools, open the\nNetwork tab, click the failed request to ",[21,252,253],{},"\u002Frest\u002Fv1\u002Fprofiles",", and read its\npayload.",[10,256,257,258,109,260,262],{},"The safer fix is to change the app, because it touches nothing in your data. Ask\nyour builder to use the column's exact name everywhere that field is saved:\n\"the column in ",[21,259,63],{},[21,261,134],{},"; use that name in every insert and\nupdate\". Renaming the column instead is a change to a live table, and any other\nscreen still using the old name breaks the first time it runs.",[10,264,265,266,271],{},"If you build with Lovable, look back through the chat for a database change you\nwere asked to approve. Lovable's\n",[66,267,270],{"href":268,"rel":269},"https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fsupabase",[70],"Supabase documentation"," says it\n\"writes the SQL, shows it to you, and asks for your approval in the project chat\nbefore running it\". Until you approve it, the column does not exist, whatever\nthe code expects.",[40,273,275],{"id":274},"cause-2-a-key-that-was-never-a-column","Cause 2: a key that was never a column",[10,277,278],{},"The request carries something the table was never meant to store: related rows\nnested inside the insert, or a field the form keeps for itself.",[10,280,281],{},"The nested insert is the one people expect to work:",[14,283,286],{"className":284,"code":285,"language":19},[17],"await supabase.from('orders').insert({\n  customer_id: user.id,\n  total: 42,\n  order_items: [{ product_id: 7, quantity: 2 }],\n})\n",[21,287,285],{"__ignoreMap":23},[10,289,290,291,294,295,298,299,304,305,310],{},"That fails with ",[21,292,293],{},"Could not find the 'order_items' column of 'orders' in the schema cache",". Reading the same shape works:\n",[21,296,297],{},".select('*, order_items(*)')"," returns an order with its items attached, so the\nreverse looks like it should too. PostgREST reads every key in a write as a\ncolumn of the one table the request is for. A Supabase user\n",[66,300,303],{"href":301,"rel":302},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase\u002Fissues\u002F50816",[70],"reported it as a bug",", and\nthe answer, before the issue was closed on 18 October 2026, was that nested\ninserts are a missing feature. The request for them has been open on\n",[66,306,309],{"href":307,"rel":308},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fissues\u002F818",[70],"PostgREST's tracker"," since\nFebruary 2017.",[10,312,313],{},"Two other shapes of the same problem:",[74,315,316,329],{},[77,317,318,319,321,322,325,326,328],{},"a row read together with its related rows, edited in a form and sent back\nwhole in ",[21,320,92],{},", so the attached ",[21,323,324],{},"order_items"," or ",[21,327,63],{}," goes with it",[77,330,331,332,334,335],{},"a form's whole state passed straight to ",[21,333,89],{},", carrying fields the form\nneeds and the table does not, such as ",[21,336,337],{},"confirmPassword",[10,339,340,341,344,345,348,349,352,353,357],{},"The fix is to write each table on its own, parent first. Insert the order and\nask for its id back with ",[21,342,343],{},".select('id').single()",", then insert the items with\nthat ",[21,346,347],{},"order_id",". Those are two requests, so if the second one fails the order is\nstill saved without its items. When that must never happen, put both inserts in\none Postgres function and call it with ",[21,350,351],{},".rpc()",", which the reply on that issue\ncalls the standard pattern. Then all of it is saved or none of it is. If that\ncall answers PGRST202 instead,\n",[66,354,356],{"href":355},"\u002Fblog\u002Fsupabase-function-not-found","the function version of this error"," explains\nwhy.",[118,359],{"alt":360,"caption":361,"src":362},"Upper lane: a slip with a second slip nested inside it goes to the orders board. Its two plain lines are ticked, and the nested one stops at an amber cross joined to a plate reading PGRST204 and 400. Lower lane: two slips sent one after the other, numbered 1 and 2, each to its own board, both ticked.","A nested slip is read as one more column of the first table. Sent separately, parent first, each one finds its own board.","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fa-key-that-is-not-a-column-1600x720.png",[40,364,366],{"id":365},"cause-3-the-change-went-into-another-project","Cause 3: the change went into another project",[10,368,369,370,374],{},"The column exists, in a database your app never talks to. One Supabase account\ncan hold several projects, and a\n",[66,371,373],{"href":372},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","branch is a separate project"," with\nits own database. A column added in the SQL Editor of the wrong one changes a\nboard in a different building.",[10,376,377,378,383],{},"On Supabase's\n",[66,379,382],{"href":380,"rel":381},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase\u002Fissues\u002F42183",[70],"issue #42183",", a report that\nthe cache \"does not update\" whatever was tried, one of PostgREST's developers\nreplied that the report named two different project references, and asked the\nreporter to confirm the change had been made in the project the requests were\ngoing to.",[10,385,386,387,390,391,394,395,399],{},"The check takes two addresses. Your app calls ",[21,388,389],{},"https:\u002F\u002F\u003Creference>.supabase.co",",\nwhich you can see on any request in the Network tab. The dashboard shows the\nproject you are in at ",[21,392,393],{},"supabase.com\u002Fdashboard\u002Fproject\u002F\u003Creference>",". The two\nreferences must be the same string.\n",[66,396,398],{"href":397},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Which project is mine"," covers finding\nit when someone else set Supabase up.",[40,401,403],{"id":402},"cause-4-the-cache-really-is-out-of-date","Cause 4: the cache really is out of date",[10,405,406,407,410,411,414,415,418,419,424],{},"This is the rare one on Supabase, because Supabase reloads the cache for you.\nEvery Supabase database is set up with an event trigger, ",[21,408,409],{},"pgrst_ddl_watch",",\nthat runs after each change to the shape of the database, ",[21,412,413],{},"ALTER TABLE","\nincluded, and sends ",[21,416,417],{},"NOTIFY pgrst, 'reload schema'",": the message that tells\nPostgREST to rebuild its list. You can read it in\n",[66,420,423],{"href":421,"rel":422},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fpostgres\u002Fblob\u002Fdevelop\u002Fmigrations\u002Fschema-17.sql",[70],"Supabase's database setup",".\nAdding a column in the Table Editor or the SQL Editor repaints the board by\nitself.",[10,426,427,428,433,434,437],{},"It goes wrong when that message never arrives. Supabase's\n",[66,429,432],{"href":430,"rel":431},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Fpostgrest-not-recognizing-new-columns-or-functions-bd75f5",[70],"troubleshooting guide","\ndescribes the case: \"an underlying Postgres notification queue issue prevents\nPostgREST from receiving cache reload signals after schema changes\". PostgREST's\nlog then shows ",[21,435,436],{},"Failed listening for database notifications on the \"pgrst\" channel",", and the board stays as it was however many columns you add.",[118,439],{"alt":440,"caption":441,"src":442},"Upper lane: ALTER TABLE adds a column to a table, a bell rings, a line marked NOTIFY pgrst reaches the profiles board, and the board gains the same new plate. Lower lane: the same change, the line cut by an amber cross, and the board with a dashed empty slot where the new plate should be.","Each ALTER TABLE on Supabase sends the reload message by itself. A stale cache means that message did not arrive.","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fthe-board-repaints-itself-1600x660.png",[40,444,446],{"id":445},"how-do-i-reload-the-supabase-schema-cache","How do I reload the Supabase schema cache?",[10,448,449],{},"Run one line in the SQL Editor:",[14,451,454],{"className":452,"code":453,"language":245,"meta":23},[243],"NOTIFY pgrst, 'reload schema';\n",[21,455,453],{"__ignoreMap":23},[10,457,458,459,464,465,470],{},"Supabase's\n",[66,460,463],{"href":461,"rel":462},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ftroubleshooting\u002Frefresh-postgrest-schema",[70],"page for it","\nsays to expect \"Success. No rows returned\" under Results. It is safe on a live\napp. PostgREST's\n",[66,466,469],{"href":467,"rel":468},"https:\u002F\u002Fdocs.postgrest.org\u002Fen\u002Fv14\u002Freferences\u002Fschema_cache.html",[70],"documentation","\nsays \"Requests will wait until the schema cache reload is done\", so nobody using\nthe app sees an error while it runs.",[10,472,473],{},"If the notification queue is the problem, the reload message gets stuck the same\nway the automatic one did. The troubleshooting guide gives a second line for\nthat:",[14,475,478],{"className":476,"code":477,"language":245,"meta":23},[243],"select pg_notification_queue_usage();\n",[21,479,477],{"__ignoreMap":23},[10,481,482],{},"Supabase says it prompts PostgREST to update its cache and \"does not require a\ndatabase instance or PostgREST service restart\". Then try the save again.",[40,484,486],{"id":485},"when-reloading-does-not-help","When reloading does not help",[10,488,489],{},"Restart the project, and if the error survives that, go back to causes 1 to 3.",[10,491,492,493,497],{},"A restart always gives PostgREST a fresh list. The same PostgREST developer\nwrote on #42183 that a restarted PostgREST \"won't go live if it doesn't load a\nnew schema cache\". Restart project sits under Project Settings, then General,\nand ",[66,494,496],{"href":495},"\u002Fblog\u002Fis-supabase-down-or-your-app","how to restart a Supabase project","\nwalks through it, including the few minutes it is offline.",[10,499,500],{},"So an error that survives a restart comes from a fresh, accurate list: that\ntable, in that project, has no column by that name. #42183 itself, opened in\nJanuary 2026 by someone who had tried a reload, a restart and dropping and\nre-adding the column, was still open when we read it on 21 October 2026. The developer's reply\nthere also suggested upgrading to PostgREST 14 from the project's\nInfrastructure settings.",[10,502,503,504,507,508,512],{},"Leave drop and re-add off your list. ",[21,505,506],{},"alter table … drop column"," deletes every\nvalue stored in that column, and the new column with the same name starts empty.\nIf you are about to change a table that real users write to, keep a copy of the\ndatabase from before the change. ",[66,509,511],{"href":510},"\u002Fsupabase-backups","Reeve Care"," makes one on a\nschedule and keeps it encrypted, on Reeve's own storage in the EU.",[40,514,516],{"id":515},"keeping-your-generated-types-in-step","Keeping your generated types in step",[10,518,519],{},"Regenerate your TypeScript types after every change to a table, and a misspelled\ncolumn name can show up in the editor before it reaches the live site.",[10,521,522,523,72],{},"Supabase builds the file from your actual columns, either from the dashboard or\nwith one command from its\n",[66,524,527],{"href":525,"rel":526},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fapi\u002Frest\u002Fgenerating-types",[70],"guide to generating types",[14,529,532],{"className":530,"code":531,"language":19},[17],"npx supabase gen types typescript --project-id \"$PROJECT_REF\" --schema public > database.types.ts\n",[21,533,531],{"__ignoreMap":23},[10,535,536,537,540,541,544,545,547],{},"When the client is created with those types, ",[21,538,539],{},"createClient\u003CDatabase>(…)",", each\ntable's ",[21,542,543],{},"Insert"," type lists the columns ",[21,546,89],{}," accepts. A misspelled column\nin an object written out in the call is then marked as an error before you\npublish. Lovable's documentation says it \"regenerates the TypeScript types your\napp uses\" after a database change. A types file generated before your last\nchange to the table still lists the old columns.",[40,549,551],{"id":550},"changing-a-live-table-without-losing-what-is-in-it","Changing a live table without losing what is in it",[10,553,554],{},"Keep a copy from before the change, and know straight away whether the app still\nanswers after it.",[10,556,557],{},[35,558,559,561],{},[66,560,511],{"href":510}," keeps a copy of your Supabase database:",[74,563,564,567,570,573,576,579],{},[77,565,566],{},"an encrypted copy on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[77,568,569],{},"the last copy before your change holds the tables and columns as they were, rows included",[77,571,572],{},"each copy verified before it counts, by counting the rows in every table",[77,574,575],{},"your uploaded files as well, once you connect a Storage credential",[77,577,578],{},"a one-click restore, with a safety copy of the current state taken first",[77,580,581],{},"everything Monitor does",[10,583,584],{},[35,585,586,590],{},[66,587,589],{"href":588},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking from outside:",[74,592,593,596,599,606],{},[77,594,595],{},"whether your app is up, checked every minute, so a broken save button and an outage are easy to tell apart",[77,597,598],{},"the full security check every hour, on up to three apps",[77,600,601,602,605],{},"a message when a result ",[35,603,604],{},"changes",", so a deploy that changes what your app exposes reaches you without you going to look",[77,607,608],{},"a monthly report, in plain language, of what it saw",[40,610,612],{"id":611},"what-to-do-now","What to do now",[614,615,616],"key-takeaways",{},[74,617,618,621,624,627,630,641],{},[77,619,620],{},"Read the two names in the message: the key your app sent and the table it went to.",[77,622,623],{},"Compare that key with the column in the Table Editor, letter for letter. A name typed in SQL without quotes is stored in lower case.",[77,625,626],{},"Look for keys that are not columns: related rows nested in an insert, or a whole row sent back with its related rows. Write each table on its own, or put both writes in one function.",[77,628,629],{},"Check that the reference in your app's Supabase address matches the project you changed.",[77,631,632,633,636,637,640],{},"If all of that matches, run ",[21,634,635],{},"NOTIFY pgrst, 'reload schema';",", then ",[21,638,639],{},"select pg_notification_queue_usage();",", and restart the project only if neither helps.",[77,642,643],{},"Regenerate your TypeScript types after every change to a table.",[10,645,646,647,650],{},"Start with the column name the message quotes, because it is exactly what your\napp sent, and the Table Editor shows exactly what the table has. Before you\nrename or drop anything in a table people use,\n",[66,648,649],{"href":510},"keep a copy of the database"," from before the change.",{"title":23,"searchDepth":652,"depth":652,"links":653},3,[654,656,657,658,659,660,661,662,663,664],{"id":42,"depth":655,"text":43},2,{"id":125,"depth":655,"text":126},{"id":274,"depth":655,"text":275},{"id":365,"depth":655,"text":366},{"id":402,"depth":655,"text":403},{"id":445,"depth":655,"text":446},{"id":485,"depth":655,"text":486},{"id":515,"depth":655,"text":516},{"id":550,"depth":655,"text":551},{"id":611,"depth":655,"text":612},"Security basics","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcover-1200x630.png","A lobby directory board with one empty slot in its list of rooms, and a delivery slip in front of it with one line lit in amber.","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.",false,"md",[672,675,678,680,683],{"q":673,"a":674},"What does PGRST204 mean?","PGRST204 is the code PostgREST, the part of Supabase that answers your app's database calls, gives a write that names a column the table does not have. It comes back with HTTP 400 and the message \"Could not find the 'x' column of 'y' in the schema cache\", where x is the key your app sent and y is the table it sent it to. Inserts, updates and upserts produce it.",{"q":676,"a":677},"I added the column and it still fails. Why?","Usually the name. Check that your app sends exactly the stored name (a column added in SQL as phoneNumber, without quotes, is stored as phonenumber), that you added it in the project your app calls, and that nothing else in the request is a key the table lacks. Supabase reloads the schema cache by itself after every ALTER TABLE, so a stale cache is the last thing to suspect.",{"q":446,"a":679},"Run NOTIFY pgrst, 'reload schema'; in the SQL Editor. If that changes nothing, Supabase's troubleshooting guide gives a second command, select pg_notification_queue_usage();, for when the reload messages are stuck. Requests that arrive during the reload wait for it to finish.",{"q":681,"a":682},"Does pausing the project clear it?","Yes. PostgREST builds a fresh schema cache every time it starts, and resuming a paused project starts it again. Restart project, under Project Settings and then General, does the same without the pause. If the error survives either, the cache was right all along: the column is missing from that table in that project.",{"q":684,"a":685},"Why do nested inserts fail with this error?","Because PostgREST reads every key in an insert as a column of one table, so a key holding related rows is a column it cannot find. Reading related rows in one request works, and writing them that way has never been supported. Insert the parent first and the children with its id, or do both inside one Postgres function called with rpc().","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",[688,689,690,691,692,693,694,695],"could not find the column in the schema cache","pgrst204","supabase could not find the column of in the schema cache","supabase schema cache not updating","notify pgrst reload schema","supabase added column not working","supabase schema cache refresh","supabase nested insert",{},true,"\u002Fblog\u002Fsupabase-schema-cache-column-error","2026-10-21",{"title":5,"description":668},"blog\u002Fsupabase-schema-cache-column-error",[703,704,705],"Supabase \"Could not find the column in the schema cache\" (PGRST204) means your app tried to save a field the table does not list. PostgREST checks every key in an insert or update against its own copy of your schema, letter for letter.","The usual cause is the name: phoneNumber sent to a column called phone_number, or a key that was never a column, such as related rows nested inside an insert.","Supabase reloads that copy by itself whenever a table changes. When it really is out of date, NOTIFY pgrst, 'reload schema'; in the SQL Editor reloads it while the app keeps running.","BZJJB7kGnxXfM7vRlqZnoU6VqwsBH5bX3Y_XtbPVM-s",[708,714,720,726,732,738,744,750,756,762,768,775,781,787,793,799,805,811,816,821,822,828,834,840,846,852,858,864,870,876,882,888,894,900,906,912,918,924,930,936,941,947,953,959,965,971,976,982,988,994,1000,1006,1012,1018,1024,1030,1036,1042,1048,1054,1060,1066,1072,1078,1084,1090,1096,1102,1108,1114,1120,1126,1132,1138,1144,1149,1155,1161,1166,1172,1178,1184,1190,1196,1201,1207,1213,1219,1224,1230],{"path":709,"title":710,"description":711,"published":712,"category":665,"image":713,"draft":669},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":715,"title":716,"description":717,"published":718,"category":665,"image":719,"draft":669},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":721,"title":722,"description":723,"published":724,"category":665,"image":725,"draft":669},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":727,"title":728,"description":729,"published":730,"category":665,"image":731,"draft":669},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":733,"title":734,"description":735,"published":736,"category":665,"image":737,"draft":669},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":739,"title":740,"description":741,"published":742,"category":665,"image":743,"draft":669},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":745,"title":746,"description":747,"published":748,"category":665,"image":749,"draft":669},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":751,"title":752,"description":753,"published":754,"category":665,"image":755,"draft":669},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":757,"title":758,"description":759,"published":760,"category":665,"image":761,"draft":669},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":763,"title":764,"description":765,"published":766,"category":665,"image":767,"draft":669},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":769,"title":770,"description":771,"published":772,"category":773,"image":774,"draft":669},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":776,"title":777,"description":778,"published":779,"category":665,"image":780,"draft":669},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":782,"title":783,"description":784,"published":785,"category":665,"image":786,"draft":669},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":788,"title":789,"description":790,"published":791,"category":665,"image":792,"draft":669},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":794,"title":795,"description":796,"published":797,"category":665,"image":798,"draft":669},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":800,"title":801,"description":802,"published":803,"category":665,"image":804,"draft":669},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":806,"title":807,"description":808,"published":809,"category":665,"image":810,"draft":669},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":103,"title":812,"description":813,"published":814,"category":665,"image":815,"draft":669},"Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":355,"title":817,"description":818,"published":819,"category":665,"image":820,"draft":669},"Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":698,"title":5,"description":668,"published":699,"category":665,"image":686,"draft":669},{"path":823,"title":824,"description":825,"published":826,"category":665,"image":827,"draft":669},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":829,"title":830,"description":831,"published":832,"category":665,"image":833,"draft":669},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":835,"title":836,"description":837,"published":838,"category":665,"image":839,"draft":669},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":841,"title":842,"description":843,"published":844,"category":665,"image":845,"draft":669},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":847,"title":848,"description":849,"published":850,"category":665,"image":851,"draft":669},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":853,"title":854,"description":855,"published":856,"category":665,"image":857,"draft":669},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":859,"title":860,"description":861,"published":862,"category":665,"image":863,"draft":669},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":865,"title":866,"description":867,"published":868,"category":665,"image":869,"draft":669},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":871,"title":872,"description":873,"published":874,"category":665,"image":875,"draft":669},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":877,"title":878,"description":879,"published":880,"category":665,"image":881,"draft":669},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":883,"title":884,"description":885,"published":886,"category":665,"image":887,"draft":669},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":889,"title":890,"description":891,"published":892,"category":665,"image":893,"draft":669},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":895,"title":896,"description":897,"published":898,"category":665,"image":899,"draft":669},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":901,"title":902,"description":903,"published":904,"category":665,"image":905,"draft":669},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":907,"title":908,"description":909,"published":910,"category":665,"image":911,"draft":669},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":913,"title":914,"description":915,"published":916,"category":665,"image":917,"draft":669},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":919,"title":920,"description":921,"published":922,"category":665,"image":923,"draft":669},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":925,"title":926,"description":927,"published":928,"category":665,"image":929,"draft":669},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":931,"title":932,"description":933,"published":934,"category":665,"image":935,"draft":669},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":495,"title":937,"description":938,"published":939,"category":665,"image":940,"draft":669},"Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":942,"title":943,"description":944,"published":945,"category":665,"image":946,"draft":669},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":948,"title":949,"description":950,"published":951,"category":665,"image":952,"draft":669},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":954,"title":955,"description":956,"published":957,"category":773,"image":958,"draft":669},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":960,"title":961,"description":962,"published":963,"category":773,"image":964,"draft":669},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":966,"title":967,"description":968,"published":969,"category":773,"image":970,"draft":669},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":972,"title":973,"description":974,"published":969,"category":665,"image":975,"draft":669},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":977,"title":978,"description":979,"published":980,"category":665,"image":981,"draft":669},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":983,"title":984,"description":985,"published":986,"category":665,"image":987,"draft":669},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":989,"title":990,"description":991,"published":992,"category":773,"image":993,"draft":669},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":995,"title":996,"description":997,"published":998,"category":665,"image":999,"draft":669},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":1001,"title":1002,"description":1003,"published":1004,"category":665,"image":1005,"draft":669},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":1007,"title":1008,"description":1009,"published":1010,"category":665,"image":1011,"draft":669},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":1013,"title":1014,"description":1015,"published":1016,"category":665,"image":1017,"draft":669},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":1019,"title":1020,"description":1021,"published":1022,"category":665,"image":1023,"draft":669},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":1025,"title":1026,"description":1027,"published":1028,"category":665,"image":1029,"draft":669},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1031,"title":1032,"description":1033,"published":1034,"category":665,"image":1035,"draft":669},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1037,"title":1038,"description":1039,"published":1040,"category":665,"image":1041,"draft":669},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1043,"title":1044,"description":1045,"published":1046,"category":773,"image":1047,"draft":669},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1049,"title":1050,"description":1051,"published":1052,"category":773,"image":1053,"draft":669},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1055,"title":1056,"description":1057,"published":1058,"category":773,"image":1059,"draft":669},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1061,"title":1062,"description":1063,"published":1064,"category":665,"image":1065,"draft":669},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":1067,"title":1068,"description":1069,"published":1070,"category":665,"image":1071,"draft":669},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1073,"title":1074,"description":1075,"published":1076,"category":665,"image":1077,"draft":669},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1079,"title":1080,"description":1081,"published":1082,"category":665,"image":1083,"draft":669},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1085,"title":1086,"description":1087,"published":1088,"category":665,"image":1089,"draft":669},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1091,"title":1092,"description":1093,"published":1094,"category":665,"image":1095,"draft":669},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1097,"title":1098,"description":1099,"published":1100,"category":665,"image":1101,"draft":669},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1103,"title":1104,"description":1105,"published":1106,"category":665,"image":1107,"draft":669},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1109,"title":1110,"description":1111,"published":1112,"category":665,"image":1113,"draft":669},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1115,"title":1116,"description":1117,"published":1118,"category":665,"image":1119,"draft":669},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1121,"title":1122,"description":1123,"published":1124,"category":773,"image":1125,"draft":669},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1127,"title":1128,"description":1129,"published":1130,"category":665,"image":1131,"draft":669},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1133,"title":1134,"description":1135,"published":1136,"category":773,"image":1137,"draft":669},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1139,"title":1140,"description":1141,"published":1142,"category":665,"image":1143,"draft":669},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":397,"title":1145,"description":1146,"published":1147,"category":665,"image":1148,"draft":669},"Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1150,"title":1151,"description":1152,"published":1153,"category":665,"image":1154,"draft":669},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1156,"title":1157,"description":1158,"published":1159,"category":665,"image":1160,"draft":669},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":372,"title":1162,"description":1163,"published":1164,"category":773,"image":1165,"draft":669},"Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1167,"title":1168,"description":1169,"published":1170,"category":773,"image":1171,"draft":669},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1173,"title":1174,"description":1175,"published":1176,"category":665,"image":1177,"draft":669},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1179,"title":1180,"description":1181,"published":1182,"category":665,"image":1183,"draft":669},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1185,"title":1186,"description":1187,"published":1188,"category":773,"image":1189,"draft":669},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1191,"title":1192,"description":1193,"published":1194,"category":665,"image":1195,"draft":669},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1197,"title":1198,"description":1199,"published":1194,"category":665,"image":1200,"draft":669},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1202,"title":1203,"description":1204,"published":1205,"category":665,"image":1206,"draft":669},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1208,"title":1209,"description":1210,"published":1211,"category":773,"image":1212,"draft":669},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1214,"title":1215,"description":1216,"published":1217,"category":665,"image":1218,"draft":669},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1220,"title":1221,"description":1222,"published":1217,"category":773,"image":1223,"draft":669},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1225,"title":1226,"description":1227,"published":1228,"category":773,"image":1229,"draft":669},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1231,"title":1232,"description":1233,"published":1228,"category":665,"image":1234,"draft":669},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]