[{"data":1,"prerenderedAt":1042},["ShallowReactive",2],{"blog-en-supabase-single-row-error":3,"blog-index-en":511},{"id":4,"title":5,"body":6,"category":468,"cover":469,"coverAlt":470,"description":471,"draft":472,"extension":473,"faq":474,"image":490,"keywords":491,"meta":499,"navigation":500,"ogTitle":501,"path":502,"published":503,"seo":504,"stem":505,"tldr":506,"updated":503,"__hash__":510},"blog_en\u002Fblog\u002Fsupabase-single-row-error.md","Supabase \"multiple (or no) rows returned\" usually means no rows",{"type":7,"value":8,"toc":454},"minimark",[9,13,16,27,43,48,51,54,61,65,72,96,102,111,137,141,147,164,174,177,181,184,193,196,202,205,212,216,219,250,253,261,265,270,273,279,285,289,292,295,298,302,310,315,331,336,344,348,354,363,378,388,405,409,441],[10,11,12],"p",{},"Your app tells somebody a record cannot be found. You open the Supabase table\neditor and the record is sitting right there, in the table, with the right id.",[10,14,15],{},"What came back from the database was this:",[17,18,23],"pre",{"className":19,"code":21,"language":22},[20],"language-text","{\n  \"code\": \"PGRST116\",\n  \"message\": \"JSON object requested, multiple (or no) rows returned\",\n  \"details\": \"Results contain 0 rows, application\u002Fvnd.pgrst.object+json requires 1 row\"\n}\n","text",[24,25,21],"code",{"__ignoreMap":26},"",[10,28,29,30,34,35,38,39,42],{},"Here is the part that guide after guide gets wrong: ",[31,32,33],"strong",{},"zero rows is an answer your\nown rules can produce, and it reads exactly like data that is gone."," Search this\nmessage and you are told to swap ",[24,36,37],{},".single()"," for ",[24,40,41],{},".maybeSingle()",". That does stop\nthe error. It tells you nothing about whether the row was missing or whether your\nvisitor was never allowed to see it, and those two have different repairs.",[44,45,47],"h2",{"id":46},"what-does-json-object-requested-multiple-or-no-rows-returned-mean","What does \"JSON object requested, multiple (or no) rows returned\" mean?",[10,49,50],{},"Your query asked the database for exactly one row and the result held a different\nnumber. Nearly always that number is zero.",[10,52,53],{},"Think of a reading room where you fill in a slip and somebody behind the counter\nfetches the book. Your slip says: bring me the one book with this number. The\ncounter comes back and tells you there is nothing matching the slip. That is the\nonly answer the counter gives, and it is the same answer whether the book was\nnever in the catalogue or whether it is on a shelf you are not cleared for.\nNobody is being coy with you. The slip system was built so that what you are not\ncleared for is simply absent from your view of the catalogue.",[10,55,56,57,60],{},"Your app is the one holding the slip, and the number the counter came back with\nis written in the ",[24,58,59],{},"details"," line of the reply.",[44,62,64],{"id":63},"two-different-messages-and-the-same-error-code","Two different messages, and the same error code",[10,66,67,68,71],{},"The code is stable and the sentence is not, so match on ",[24,69,70],{},"PGRST116",".",[10,73,74,75,78,79,81,82,85,86,89,90,92,93,71],{},"Two wordings are in circulation for this one error, and which you see depends on\nwhich version of PostgREST your project runs. PostgREST is the server that turns\nyour Supabase tables into the HTTP API your app talks to. Its documentation for\nversion 12 gives the message as ",[24,76,77],{},"JSON object requested, multiple (or no) rows returned",", with a ",[24,80,59],{}," line reading\n",[24,83,84],{},"Results contain 0 rows, application\u002Fvnd.pgrst.object+json requires 1 row",".\nIn versions 13 and 14 the same situation is documented as\n",[24,87,88],{},"Cannot coerce the result to a single JSON object",", with ",[24,91,59],{}," reading\n",[24,94,95],{},"The result contains 0 rows",[10,97,98,99,101],{},"The older sentence has a second life beyond old projects. When you call\n",[24,100,41],{}," and more than one row matches, the Supabase JavaScript client\nwrites the error itself rather than passing one on from the server, and the\nmessage it writes is the older wording. So the first sentence is still arriving\nin apps whose database would have sent the second one.",[10,103,104,105,107,108,110],{},"What does not move is the code. PostgREST's error table lists ",[24,106,70],{}," at 406\nin all three versions, with the same description: more than one row, or none,\nwhen exactly one was requested. Read the ",[24,109,24],{}," field and ignore the prose.",[112,113,115],"callout",{"type":114},"warn",[10,116,117,120,121,124,125,128,129,132,133,136],{},[31,118,119],{},"If you are matching the message as a string in your own code, match the code\ninstead."," A ",[24,122,123],{},"catch"," block that compares ",[24,126,127],{},"error.message"," against\n",[24,130,131],{},"'JSON object requested, multiple (or no) rows returned'"," works today and stops\nworking on the day your project moves to a newer PostgREST, with no deploy of\nyours in between. ",[24,134,135],{},"error.code === 'PGRST116'"," survives that.",[44,138,140],{"id":139},"why-single-produces-this-at-all","Why .single() produces this at all",[10,142,143,144,146],{},"Because ",[24,145,37],{}," is an instruction about the shape of the reply rather than a\nfilter on the data.",[10,148,149,150,152,153,156,157,160,161,71],{},"When you write ",[24,151,37],{},", the Supabase client adds one header to the request:\n",[24,154,155],{},"Accept: application\u002Fvnd.pgrst.object+json",". That header asks the database to\nsend the row on its own, as a record. It is what lets your code write ",[24,158,159],{},"data.name","\nwhere it would otherwise have to write ",[24,162,163],{},"data[0].name",[10,165,166,167,169,170,173],{},"The database honours it strictly. One row goes back as a record. Any other number\nof rows cannot be sent in that shape at all, so the reply is a 406 and an error\nobject. Drop the ",[24,168,37],{}," and the identical query returns ",[24,171,172],{},"[]"," with a 200 and\nno error anywhere.",[10,175,176],{},"So nothing had to break to produce this. An empty result became an error because\nyour query said the reply had to hold exactly one record.",[44,178,180],{"id":179},"cause-1-the-row-is-there-and-your-rules-say-no","Cause 1: the row is there and your rules say no",[10,182,183],{},"Row level security does not refuse your query. It takes rows out of it, and a row\ntaken out of a result was never in the result to be counted.",[10,185,186,187,189,190,192],{},"Row level security is the set of rules on each Supabase table that decides, row by\nrow, which rows a given visitor is allowed to read. When no rule allows your\nvisitor to read the row your query named, that row is removed before the result is\nmeasured. The count is zero. Your ",[24,188,37],{}," wanted one. You get ",[24,191,70],{},", and\nno part of the reply mentions that a rule was involved.",[10,194,195],{},"That is the reading room again, and it is why the counter says the same thing\ntwice. Your clearance is applied before the shelf is even searched, so a book you\ncannot borrow and a book that does not exist produce one identical slip coming\nback.",[197,198],"diagram",{"alt":199,"caption":200,"src":201},"One request entering from the left and splitting into two lanes. In the upper lane a shelf holds a row drawn in teal, and the lane is stopped short by an amber bar before it reaches the shelf. In the lower lane the shelf is empty and drawn as a dashed outline. Both lanes end at the same empty tray, marked with a zero.","A row your rules hide and a row that is not there both leave the result with nothing in it. The reply counts rows, so the two arrive as the same error.","\u002Fblog\u002Fsupabase-single-row-error\u002Ftwo-reasons-one-answer-1600x700.png",[10,203,204],{},"This is also why the table editor misleads you. The SQL editor and the table\neditor in your Supabase dashboard run with privileges your policies do not apply\nto, so they show you every row. Your app's request carries your publishable key\nand your visitor's session, and the policies do apply to it. Two views of one\ntable, and only one of them is the view your users get.",[10,206,207,208,211],{},"That difference is readable from outside, which is how we can count it. Our\nscanner reads live apps the way a stranger would. Behind 8,435 of the apps it has\ngraded there is a Supabase project. On 3,680 of those, the question \"can somebody\nwith no account read this table\" got a usable answer at all, and ",[31,209,210],{},"1,584 of them\nanswered no",": a stranger asking for the rows got nothing back. That nothing is\nthe same nothing your own app receives when a policy does not match it.",[44,213,215],{"id":214},"how-to-tell-a-hidden-row-from-a-missing-one","How to tell a hidden row from a missing one",[10,217,218],{},"Run the same lookup twice, once where the policies apply and once where they do\nnot. One query settles it.",[220,221,222,238,244],"ol",{},[223,224,225,226,229,230,233,234,237],"li",{},"Open your Supabase dashboard, go to the ",[31,227,228],{},"SQL editor",", and select the row by\nthe same value your app used:\n",[24,231,232],{},"select * from your_table where id = 'the-id-your-app-sent';",". A query from\nthe SQL editor is run through the ",[24,235,236],{},"postgres"," role, which your policies do not\napply to.",[223,239,240,243],{},[31,241,242],{},"If that returns the row",", the row exists and something between your app and\nthe row removed it. That something is a policy, and you are in cause 1. Read\nthe policies on that table.",[223,245,246,249],{},[31,247,248],{},"If that returns nothing either",", the row is genuinely absent and you are in\ncause 3 below. Nothing is wrong with your rules.",[10,251,252],{},"Do this before you change a line of code. Both causes produce the same error\nobject, and the two repairs have nothing in common.",[10,254,255,256,71],{},"While you are looking at the policies on that table, it is worth knowing what\nthey currently say to somebody with no account at all. Our free scan reads your\nlive app and tells you which of your tables answer a stranger. It takes about 20\nseconds and needs no account: ",[257,258,260],"a",{"href":259},"\u002Fsecurity-scanner","scan your app",[44,262,264],{"id":263},"cause-2-more-than-one-row-came-back","Cause 2: more than one row came back",[10,266,267,269],{},[24,268,37],{}," was used on a lookup that can match more than one row.",[10,271,272],{},"A lookup by a primary key matches one row or none, by definition. A lookup by\nemail, by slug, by name, by a status, by a foreign key: every one of those can\nmatch two. The usual history is that the column held one value per row in your\ntest data and stopped doing so once real people arrived.",[10,274,275,276,278],{},"The reply tells you which cause you are in. Both wordings of the ",[24,277,59],{}," line\nstate how many rows the result contained. Zero sends you to cause 1 or cause 3. A\nnumber above zero means this one, and it is the count of rows that matched.",[10,280,281,282,284],{},"The repair is not ",[24,283,41],{},". That accepts zero rows and still errors on\ntwo, so it changes nothing here. Either filter the query down to one row with the\ncolumn that is genuinely unique, or accept that there are several and read a list.",[44,286,288],{"id":287},"cause-3-the-row-really-is-gone","Cause 3: the row really is gone",[10,290,291],{},"Sometimes the row is absent, and the query in the previous section is what rules\nit in.",[10,293,294],{},"The ordinary reasons, in the order they turn up in a vibe-coded app. The value\nyour query filtered on was empty, because the id had not loaded when the query\nran, so nothing matched. The row was deleted, by you or by a prompt that rewrote\nmore than you expected. Or the query names a table that was rebuilt under a\ndifferent name and the old rows went with the old table.",[10,296,297],{},"None of those is a security problem, and none of them is fixed by changing a\npolicy. If the SQL editor finds nothing, stop reading about row level security and\ngo and look at what your app is passing in.",[44,299,301],{"id":300},"single-or-maybesingle-which-one-your-query-wants","single or maybeSingle: which one your query wants",[10,303,304,306,307,309],{},[24,305,41],{}," where finding nothing is a legal answer. ",[24,308,37],{}," where it is\nnot.",[10,311,312,314],{},[24,313,37],{}," treats any number of rows other than one as an error. That is the\nright behaviour for a lookup by a primary key, where zero rows means the record\nyour code is about does not exist and carrying on would be worse than stopping.",[10,316,317,319,320,323,324,327,328,330],{},[24,318,41],{}," accepts zero rows: it hands you ",[24,321,322],{},"data"," as ",[24,325,326],{},"null",", with no error\nand a 200. More than one row is still an error, with the same ",[24,329,70],{}," code. So\nit fits a profile row that may not have been created yet, or an optional record\nyour page renders a blank state for.",[197,332],{"alt":333,"caption":334,"src":335},"Two lanes labelled single and maybeSingle. Each lane has three slots marked 0, 1 and 2. In the single lane the 1 slot is accepted in teal and the 0 and 2 slots are stopped by amber bars. In the maybeSingle lane the 0 and 1 slots are accepted and only the 2 slot is stopped.","The only difference is what each one does with an empty result. Both refuse two rows, and neither changes what the database actually returned.","\u002Fblog\u002Fsupabase-single-row-error\u002Fwhat-each-one-accepts-1600x640.png",[10,337,338,339,38,341,343],{},"One thing to be careful about. Swapping ",[24,340,37],{},[24,342,41],{}," changes\nhow your app behaves and changes nothing about what the database sent. If\na policy was hiding the row, you have turned a visible error into a page that\nrenders as though the record does not exist, for the one person who was supposed\nto see it. The error was telling you something. Make the swap after the test\nabove, once you know zero is the honest answer.",[44,345,347],{"id":346},"keeping-an-eye-on-your-rules-after-you-change-them","Keeping an eye on your rules after you change them",[10,349,350,353],{},[31,351,352],{},"A policy you widen to clear this error is a change nobody sees from inside your\napp."," Your own session goes on working, the error is gone, and whether that table\nnow answers a stranger is a question somebody has to go and ask.",[10,355,356],{},[31,357,358,362],{},[257,359,361],{"href":360},"\u002Fwebsite-monitoring","Reeve Monitor"," asks it for you:",[364,365,366,369,372,375],"ul",{},[223,367,368],{},"all nine checks every hour, on up to three apps",[223,370,371],{},"an email the day a re-scan grades your app lower than the one before",[223,373,374],{},"whether the app is up, every 60 seconds",[223,376,377],{},"a monthly report of what it saw",[10,379,380],{},[31,381,382,383,387],{},"A rule relaxed far enough to clear an error can let a stranger change rows as\nwell as read them. ",[257,384,386],{"href":385},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase\ndatabase where no change to your rules can reach it.",[364,389,390,393,396,399,402],{},[223,391,392],{},"an encrypted copy every day, kept outside your Supabase account",[223,394,395],{},"each copy verified before it counts, by counting the rows in every table",[223,397,398],{},"a one-click restore that saves what is there now before it replaces anything",[223,400,401],{},"your uploaded files as well, once you connect a Storage credential",[223,403,404],{},"everything Monitor does",[44,406,408],{"id":407},"what-to-do-today","What to do today",[410,411,412],"key-takeaways",{},[364,413,414,423,429,432,438],{},[223,415,416,417,419,420,422],{},"Match on the ",[24,418,24],{}," field. ",[24,421,70],{}," arrives under two different sentences, and which one you get depends on the PostgREST version your project runs.",[223,424,425,426,428],{},"Read the row count in the ",[24,427,59],{}," line. Zero means an empty result. Anything above zero means your lookup matched several rows and needs a column that is unique.",[223,430,431],{},"On an empty result, run the same lookup in the SQL editor before you change any code. If the row comes back there and not in your app, a policy removed it.",[223,433,434,435,437],{},"Switch to ",[24,436,41],{}," once you know zero is the honest answer. On a row a policy is hiding, it replaces an error with a blank page and no warning.",[223,439,440],{},"After you change a policy to clear this, check what that table now returns to somebody with no account.",[10,442,443,444,448,449,453],{},"Start with one query in the SQL editor, because it decides which half of this\narticle applies to you. If it turns out a policy was the answer, ",[257,445,447],{"href":446},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","turning row\nlevel security on for every table","\ncovers writing a rule that lets the right person through, and\n",[257,450,452],{"href":451},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","\"new row violates row-level security policy\"","\nis the message you get when a policy refuses a write you can see with your own\neyes.",{"title":26,"searchDepth":455,"depth":455,"links":456},3,[457,459,460,461,462,463,464,465,466,467],{"id":46,"depth":458,"text":47},2,{"id":63,"depth":458,"text":64},{"id":139,"depth":458,"text":140},{"id":179,"depth":458,"text":180},{"id":214,"depth":458,"text":215},{"id":263,"depth":458,"text":264},{"id":287,"depth":458,"text":288},{"id":300,"depth":458,"text":301},{"id":346,"depth":458,"text":347},{"id":407,"depth":458,"text":408},"Security basics","\u002Fblog\u002Fsupabase-single-row-error\u002Fcover-1200x630.png","A request slip and an empty return tray at a counter, with a shelf behind it holding one row picked out in teal behind an amber bar.","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.",false,"md",[475,478,481,484,487],{"q":476,"a":477},"What does PGRST116 mean?","It means your query asked the database for exactly one row and the result held a different number. PostgREST, the part of Supabase that answers your app over HTTP, returns it as HTTP 406 with the code PGRST116. The count is in the details line of the reply, and nearly always it is zero.",{"q":479,"a":480},"Why does my query return no rows when I can see the row in Supabase?","Because the SQL editor in your dashboard runs with privileges your row level security policies do not apply to, and your app does not. If no policy allows your visitor to read that row, the row is removed from their result before the result is counted, and what comes back is a count of zero. The row is there. It was never in the reply.",{"q":482,"a":483},"What is the difference between single and maybeSingle?","single() treats anything other than exactly one row as an error. maybeSingle() accepts zero rows and hands you data as null with no error, and it still errors when more than one row matches. So maybeSingle() is right where finding nothing is a legal answer, such as a profile that may not exist yet, and single() is right for a lookup by a column that can only ever match one row.",{"q":485,"a":486},"Does row level security cause this error?","It is the commonest cause in an app built with Lovable, Bolt, Replit or v0. Row level security filters rows out of a result rather than refusing the request, so a row nobody is allowed to read is indistinguishable from a row that does not exist. Both produce a count of zero, and a query asking for exactly one row fails on both.",{"q":488,"a":489},"Why is it a 406?","406 Not Acceptable is the status for a request the server cannot answer in the form that was asked for. Your query carried an Accept header saying the reply had to be one record rather than a list, and with no row to put in it there is no acceptable reply to send. Drop that header and the same query returns an empty list with a 200.","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",[492,493,494,495,496,497,498],"json object requested multiple (or no) rows returned","pgrst116","supabase single row error","supabase single() error","406 not acceptable supabase","maybesingle supabase","supabase returns no rows but row exists",{},true,"\"Multiple (or no) rows returned\" usually means no rows","\u002Fblog\u002Fsupabase-single-row-error","2026-10-15",{"title":5,"description":471},"blog\u002Fsupabase-single-row-error",[507,508,509],"\"JSON object requested, multiple (or no) rows returned\" is error PGRST116, and it means your query came back with a number of rows other than one. Nearly always that number is zero.","With row level security switched on, a row your visitor is not allowed to read comes back as no row at all. So a record you can see in the Supabase table editor can be absent from your app while the data is perfectly fine.","Use maybeSingle() where finding nothing is a legal answer and single() where it is not. Run one query in the SQL editor first, so you know which of the two you have.","cs3FEfbxYWAj-lx1OS2rAE817L2aeVS8KKHx1R3Yi0U",[512,518,524,530,536,542,548,554,560,566,572,579,585,591,597,603,609,615,621,627,633,639,645,651,657,663,664,670,676,682,688,694,700,706,712,718,724,730,736,742,748,754,760,766,772,778,783,789,795,801,807,813,819,825,831,837,843,849,855,861,867,873,878,884,890,896,902,908,914,920,926,932,938,944,950,956,961,967,973,979,985,991,997,1003,1008,1014,1020,1026,1031,1037],{"path":513,"title":514,"description":515,"published":516,"category":468,"image":517,"draft":472},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":519,"title":520,"description":521,"published":522,"category":468,"image":523,"draft":472},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":525,"title":526,"description":527,"published":528,"category":468,"image":529,"draft":472},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":531,"title":532,"description":533,"published":534,"category":468,"image":535,"draft":472},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":537,"title":538,"description":539,"published":540,"category":468,"image":541,"draft":472},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":543,"title":544,"description":545,"published":546,"category":468,"image":547,"draft":472},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":549,"title":550,"description":551,"published":552,"category":468,"image":553,"draft":472},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":555,"title":556,"description":557,"published":558,"category":468,"image":559,"draft":472},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":561,"title":562,"description":563,"published":564,"category":468,"image":565,"draft":472},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":567,"title":568,"description":569,"published":570,"category":468,"image":571,"draft":472},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":573,"title":574,"description":575,"published":576,"category":577,"image":578,"draft":472},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":580,"title":581,"description":582,"published":583,"category":468,"image":584,"draft":472},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":586,"title":587,"description":588,"published":589,"category":468,"image":590,"draft":472},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":592,"title":593,"description":594,"published":595,"category":468,"image":596,"draft":472},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":598,"title":599,"description":600,"published":601,"category":468,"image":602,"draft":472},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":604,"title":605,"description":606,"published":607,"category":468,"image":608,"draft":472},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":610,"title":611,"description":612,"published":613,"category":468,"image":614,"draft":472},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":616,"title":617,"description":618,"published":619,"category":468,"image":620,"draft":472},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":622,"title":623,"description":624,"published":625,"category":468,"image":626,"draft":472},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":628,"title":629,"description":630,"published":631,"category":468,"image":632,"draft":472},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":634,"title":635,"description":636,"published":637,"category":468,"image":638,"draft":472},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":640,"title":641,"description":642,"published":643,"category":468,"image":644,"draft":472},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":646,"title":647,"description":648,"published":649,"category":468,"image":650,"draft":472},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":652,"title":653,"description":654,"published":655,"category":468,"image":656,"draft":472},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":658,"title":659,"description":660,"published":661,"category":468,"image":662,"draft":472},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":502,"title":5,"description":471,"published":503,"category":468,"image":490,"draft":472},{"path":665,"title":666,"description":667,"published":668,"category":468,"image":669,"draft":472},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":671,"title":672,"description":673,"published":674,"category":468,"image":675,"draft":472},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":677,"title":678,"description":679,"published":680,"category":468,"image":681,"draft":472},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":683,"title":684,"description":685,"published":686,"category":468,"image":687,"draft":472},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":689,"title":690,"description":691,"published":692,"category":468,"image":693,"draft":472},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":695,"title":696,"description":697,"published":698,"category":468,"image":699,"draft":472},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":701,"title":702,"description":703,"published":704,"category":468,"image":705,"draft":472},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":707,"title":708,"description":709,"published":710,"category":468,"image":711,"draft":472},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":713,"title":714,"description":715,"published":716,"category":468,"image":717,"draft":472},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":719,"title":720,"description":721,"published":722,"category":468,"image":723,"draft":472},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":725,"title":726,"description":727,"published":728,"category":468,"image":729,"draft":472},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":731,"title":732,"description":733,"published":734,"category":468,"image":735,"draft":472},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":737,"title":738,"description":739,"published":740,"category":468,"image":741,"draft":472},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":743,"title":744,"description":745,"published":746,"category":468,"image":747,"draft":472},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":749,"title":750,"description":751,"published":752,"category":468,"image":753,"draft":472},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":755,"title":756,"description":757,"published":758,"category":468,"image":759,"draft":472},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":761,"title":762,"description":763,"published":764,"category":577,"image":765,"draft":472},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":767,"title":768,"description":769,"published":770,"category":577,"image":771,"draft":472},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":773,"title":774,"description":775,"published":776,"category":577,"image":777,"draft":472},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":779,"title":780,"description":781,"published":776,"category":468,"image":782,"draft":472},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":784,"title":785,"description":786,"published":787,"category":468,"image":788,"draft":472},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":790,"title":791,"description":792,"published":793,"category":468,"image":794,"draft":472},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":796,"title":797,"description":798,"published":799,"category":577,"image":800,"draft":472},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":802,"title":803,"description":804,"published":805,"category":468,"image":806,"draft":472},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":808,"title":809,"description":810,"published":811,"category":468,"image":812,"draft":472},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":814,"title":815,"description":816,"published":817,"category":468,"image":818,"draft":472},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":820,"title":821,"description":822,"published":823,"category":468,"image":824,"draft":472},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":826,"title":827,"description":828,"published":829,"category":468,"image":830,"draft":472},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":832,"title":833,"description":834,"published":835,"category":468,"image":836,"draft":472},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":838,"title":839,"description":840,"published":841,"category":468,"image":842,"draft":472},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":844,"title":845,"description":846,"published":847,"category":468,"image":848,"draft":472},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":850,"title":851,"description":852,"published":853,"category":577,"image":854,"draft":472},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":856,"title":857,"description":858,"published":859,"category":577,"image":860,"draft":472},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":862,"title":863,"description":864,"published":865,"category":577,"image":866,"draft":472},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":868,"title":869,"description":870,"published":871,"category":468,"image":872,"draft":472},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":446,"title":874,"description":875,"published":876,"category":468,"image":877,"draft":472},"Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":879,"title":880,"description":881,"published":882,"category":468,"image":883,"draft":472},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":885,"title":886,"description":887,"published":888,"category":468,"image":889,"draft":472},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":891,"title":892,"description":893,"published":894,"category":468,"image":895,"draft":472},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":897,"title":898,"description":899,"published":900,"category":468,"image":901,"draft":472},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":903,"title":904,"description":905,"published":906,"category":468,"image":907,"draft":472},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":909,"title":910,"description":911,"published":912,"category":468,"image":913,"draft":472},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":915,"title":916,"description":917,"published":918,"category":468,"image":919,"draft":472},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":921,"title":922,"description":923,"published":924,"category":468,"image":925,"draft":472},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":927,"title":928,"description":929,"published":930,"category":577,"image":931,"draft":472},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":933,"title":934,"description":935,"published":936,"category":468,"image":937,"draft":472},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":939,"title":940,"description":941,"published":942,"category":577,"image":943,"draft":472},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":945,"title":946,"description":947,"published":948,"category":468,"image":949,"draft":472},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":951,"title":952,"description":953,"published":954,"category":468,"image":955,"draft":472},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":451,"title":957,"description":958,"published":959,"category":468,"image":960,"draft":472},"New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":962,"title":963,"description":964,"published":965,"category":468,"image":966,"draft":472},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":968,"title":969,"description":970,"published":971,"category":577,"image":972,"draft":472},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":974,"title":975,"description":976,"published":977,"category":577,"image":978,"draft":472},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":980,"title":981,"description":982,"published":983,"category":468,"image":984,"draft":472},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":986,"title":987,"description":988,"published":989,"category":468,"image":990,"draft":472},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":992,"title":993,"description":994,"published":995,"category":577,"image":996,"draft":472},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":998,"title":999,"description":1000,"published":1001,"category":468,"image":1002,"draft":472},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1004,"title":1005,"description":1006,"published":1001,"category":468,"image":1007,"draft":472},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1009,"title":1010,"description":1011,"published":1012,"category":468,"image":1013,"draft":472},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1015,"title":1016,"description":1017,"published":1018,"category":577,"image":1019,"draft":472},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1021,"title":1022,"description":1023,"published":1024,"category":468,"image":1025,"draft":472},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1027,"title":1028,"description":1029,"published":1024,"category":577,"image":1030,"draft":472},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1032,"title":1033,"description":1034,"published":1035,"category":577,"image":1036,"draft":472},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1038,"title":1039,"description":1040,"published":1035,"category":468,"image":1041,"draft":472},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]