[{"data":1,"prerenderedAt":1271},["ShallowReactive",2],{"blog-en-supabase-users-logged-out":3,"blog-index-en":742},{"id":4,"title":5,"body":6,"category":701,"cover":702,"coverAlt":703,"description":704,"draft":705,"extension":706,"faq":707,"image":723,"keywords":724,"meta":731,"navigation":732,"ogTitle":5,"path":733,"published":734,"seo":735,"stem":736,"tldr":737,"updated":734,"__hash__":741},"blog_en\u002Fblog\u002Fsupabase-users-logged-out.md","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes",{"type":7,"value":8,"toc":686},"minimark",[9,13,24,27,35,40,43,62,84,110,114,117,126,216,224,228,231,237,259,265,269,290,293,296,302,305,310,314,326,339,357,362,368,372,375,397,413,416,420,426,429,433,452,455,513,520,526,529,533,536,563,572,578,582,585,594,612,621,641,645,680],[10,11,12],"p",{},"Your users write in to say they were signed out. One was halfway through a form,\nand another is sure they never pressed anything. When you try the app yourself,\nit works. Then you open your logs and find the same line, again and again:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","AuthApiError: Invalid Refresh Token: Refresh Token Not Found\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26],{},"Supabase \"Invalid Refresh Token: Refresh Token Not Found\" is Supabase Auth, the\npart of Supabase that signs people in, saying it has no record of the token your\napp sent to keep a session going. With nothing left to renew, your app signs the\nuser out.",[10,28,29,30,34],{},"Here is the part that is easy to get backwards: ",[31,32,33],"strong",{},"this error is the last step,\nand the cause came earlier."," By the time Supabase cannot find the token, the\nsession it belonged to has already ended. A sign-out ended it, or a token sent\ntwice, or a limit somebody set. Making the access token last longer, or turning\noff the check that ends a session, makes the line rarer in your logs and leaves\nthe cause exactly where it was.",[36,37,39],"h2",{"id":38},"what-does-invalid-refresh-token-refresh-token-not-found-mean","What does \"Invalid Refresh Token: Refresh Token Not Found\" mean?",[10,41,42],{},"It means Supabase Auth was handed a refresh token it has no record of, so it\nrefused to renew the session.",[10,44,45,46,49,50,53,54,61],{},"Every signed-in user holds two tokens. The ",[31,47,48],{},"access token"," works like a\nwristband: it proves who they are for a short while, an hour unless you have\nchanged the setting, and your app shows it with every request. The ",[31,51,52],{},"refresh\ntoken"," is a ticket. Before the wristband runs out, your app takes the ticket to\nthe desk, which is Supabase Auth, and trades it for a new wristband and a new\nticket. Supabase's ",[55,56,60],"a",{"href":57,"rel":58},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fsessions",[59],"nofollow","guide to sessions","\nsays refresh tokens \"never expire but can only be used once\".",[10,63,64,67,68,71,72,77,78,83],{},[21,65,66],{},"Refresh Token Not Found"," is the desk looking a ticket up and finding nothing.\nThe server answers with HTTP 400 and the code ",[21,69,70],{},"refresh_token_not_found",", which\nSupabase's ",[55,73,76],{"href":74,"rel":75},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fdebugging\u002Ferror-codes",[59],"list of Auth error codes","\ndescribes as \"Session containing the refresh token not found.\" If the wristband\nhas run out as well,\n",[55,79,82],{"href":80,"rel":81},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase-js\u002Fblob\u002Fmaster\u002Fpackages\u002Fcore\u002Fauth-js\u002Fsrc\u002FGoTrueClient.ts",[59],"Supabase's JavaScript client","\nthen removes the session from the browser and tells your app the user signed\nout. That is the moment your user meets the sign-in page.",[10,85,86,87,91,92,95,96,100,101,104,105,109],{},"Neither token is one of your project's API keys, which are a separate question:\n",[55,88,90],{"href":89},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","which of those belong in your app",".\nIf your message says ",[21,93,94],{},"Invalid JWT"," instead, the wristband was refused rather\nthan the ticket, and ",[55,97,99],{"href":98},"\u002Fblog\u002Fsupabase-invalid-jwt","that error has its own page",".\nIf they cannot get back in afterwards and the sign-in form says\n",[21,102,103],{},"Invalid login credentials",",\n",[55,106,108],{"href":107},"\u002Fblog\u002Fsupabase-invalid-login","that message covers three different people",".",[36,111,113],{"id":112},"why-do-my-supabase-users-get-logged-out","Why do my Supabase users get logged out?",[10,115,116],{},"Because the session behind their ticket ended, and the wristband they still wear\nkept them signed in until it ran out. That delay, up to an hour with the default\nsetting, is why the logouts look random: the user is thrown out a while after\nthe session ended.",[10,118,119,120,125],{},"Supabase Auth has four ways of saying a ticket is no good, and each points at a\ndifferent cause. These are the exact messages from\n",[55,121,124],{"href":122,"rel":123},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Ftokens\u002Fservice.go",[59],"the Supabase Auth server's own code",":",[127,128,129,145],"table",{},[130,131,132],"thead",{},[133,134,135,139,142],"tr",{},[136,137,138],"th",{},"The message in your log",[136,140,141],{},"The code",[136,143,144],{},"What happened",[146,147,148,163,178,201],"tbody",{},[133,149,150,156,160],{},[151,152,153],"td",{},[21,154,155],{},"Invalid Refresh Token: Refresh Token Not Found",[151,157,158],{},[21,159,70],{},[151,161,162],{},"The desk has no record of this ticket. A sign-out ended its session, or it was traded in long enough ago that its record is gone.",[133,164,165,170,175],{},[151,166,167],{},[21,168,169],{},"Invalid Refresh Token: Already Used",[151,171,172],{},[21,173,174],{},"refresh_token_already_used",[151,176,177],{},"The ticket was traded in more than ten seconds ago and has come back. Supabase ends the whole session when this happens.",[133,179,180,193,198],{},[151,181,182,185,186,189,190],{},[21,183,184],{},"Invalid Refresh Token: Session Expired",", sometimes with ",[21,187,188],{},"(Inactivity)"," or ",[21,191,192],{},"(Revoked by Newer Login)",[151,194,195],{},[21,196,197],{},"session_expired",[151,199,200],{},"A session limit in your Auth settings ended it.",[133,202,203,208,213],{},[151,204,205],{},[21,206,207],{},"Invalid Refresh Token: No Valid Session Found",[151,209,210],{},[21,211,212],{},"session_not_found",[151,214,215],{},"The session the ticket belonged to no longer exists.",[10,217,218,219,223],{},"Three causes sit behind these messages in Supabase's own documentation and in\nthe reports on its issue trackers, and each has its own fix. If nobody can sign\nin at all, or the whole app is blank, you are looking at something else, and\n",[55,220,222],{"href":221},"\u002Fblog\u002Fis-supabase-down-or-your-app","is Supabase down, or is it your app"," is\nwhere to start.",[36,225,227],{"id":226},"a-refresh-token-works-once","A refresh token works once",[10,229,230],{},"Each time your app renews a session, it hands the ticket over and the desk tears\nthe old one up. Supabase calls this refresh token rotation. The old ticket keeps\nworking for ten more seconds, which the sessions guide calls the reuse interval,\nso that a server and a browser renewing at nearly the same moment do not knock\neach other out. A client that traded its ticket and lost the answer on a bad\nconnection is also covered: it gets the current ticket back.",[10,232,233,234,109],{},"Outside those two cases, an old ticket coming back counts as a warning sign,\nbecause a token turning up twice is what a stolen one looks like. The guide says\nthe whole session \"is regarded as terminated and all refresh tokens belonging to\nit are marked as revoked\". The answer that time is ",[21,235,236],{},"Already Used",[10,238,239,240,242,243,246,247,252,253,255,256,258],{},"One more step turns ",[21,241,236],{}," into ",[21,244,245],{},"Not Found",". The Supabase Auth server\n",[55,248,251],{"href":249,"rel":250},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fauth\u002Fblob\u002Fmaster\u002Finternal\u002Fmodels\u002Fcleanup.go",[59],"clears out the records of torn-up tickets","\n24 hours after they were revoked. So the stale ticket that got ",[21,254,236],{},"\ntoday gets ",[21,257,66],{}," tomorrow, because the desk no longer has the\nrecord to compare it with.",[260,261],"diagram",{"alt":262,"caption":263,"src":264},"A timeline for one ticket. First it is traded at the desk for a new wristband and a new ticket, and the old one is torn. Shown again within 10 seconds, it is still accepted. Shown again later the same day, it is refused as already used. Shown again after 24 hours, the desk's ledger has an empty line where its record was.","One ticket at four moments. Inside ten seconds it still works. After that it is refused as already used, and once its record is cleared a day later, the desk cannot find it at all.","\u002Fblog\u002Fsupabase-users-logged-out\u002Fone-ticket-four-moments-1600x700.png",[36,266,268],{"id":267},"cause-1-somebody-signed-out-on-this-device-or-another","Cause 1: somebody signed out, on this device or another",[10,270,271,272,275,276,279,280,285,286,289],{},"A sign-out deletes the session on the desk's side, and every ticket from it\nbecomes one the desk cannot find. In Supabase's JavaScript client,\n",[21,273,274],{},"signOut()"," with nothing inside the brackets ends ",[31,277,278],{},"every"," session that user\nhas, on every device. Supabase's\n",[55,281,284],{"href":282,"rel":283},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fsignout",[59],"guide to signing out"," says so\ndirectly: with that default, the other sessions \"fail with\n",[21,287,288],{},"AuthApiError: Invalid Refresh Token: Refresh Token Not Found"," the next time\nthey try to refresh, even though no one signed out on that device.\"",[10,291,292],{},"So a user who signs out on their phone is signed out of their laptop as well, up\nto an hour later, when the laptop's wristband runs out and its ticket comes back\nunknown. From where they sit, your app threw them out for no reason.",[10,294,295],{},"If each device should stay signed in on its own, the sign-out call has to end\nonly the session it was made from:",[14,297,300],{"className":298,"code":299,"language":19},[17],"await supabase.auth.signOut({ scope: 'local' })\n",[21,301,299],{"__ignoreMap":23},[10,303,304],{},"Ask your builder to use that form everywhere your app signs people out. The\nother ordinary way to end a session is a password change, which Supabase's\nsessions guide lists among the things that terminate one.",[260,306],{"alt":307,"caption":308,"src":309},"Two panels. In the left one, a phone signs out with signOut() and the tickets held by the phone, a laptop and a tablet are all torn. In the right one, the phone signs out with scope local, and only the phone's ticket is torn while the laptop and tablet keep theirs.","With no scope, one sign-out ends the session on every device. With scope local, it ends only the one in your hand.","\u002Fblog\u002Fsupabase-users-logged-out\u002Fone-sign-out-every-device-1600x720.png",[36,311,313],{"id":312},"cause-2-the-new-ticket-never-reached-the-browser","Cause 2: the new ticket never reached the browser",[10,315,316,317,320,321,323,324,109],{},"If your app renders pages on a server, as a Next.js app does, that server\nrenews sessions too. It reads the ticket from a cookie, trades it at the desk,\nand has to send the new ticket back to the browser in a ",[21,318,319],{},"Set-Cookie"," header on\nits response. When that cookie does not arrive, the browser keeps the old\nticket, and the next request presents a ticket the server has already traded.\nInside ten seconds that passes. After that it is ",[21,322,236],{}," and the session\nends, and a day later the same ticket is ",[21,325,245],{},[10,327,328,329,334,335,338],{},"Supabase's\n",[55,330,333],{"href":331,"rel":332},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fauth\u002Fserver-side\u002Fcreating-a-client",[59],"guide to creating a server client","\nnames the mistake that does this in a Next.js app. The code that renews the\nsession, which Next.js 16 calls the Proxy and earlier versions call middleware,\nmust return the response the new cookies were written to: \"An earlier response\ndoesn't carry the refreshed cookies, so the user is signed out on the next\nrequest.\" The same guide warns that on Next.js 15 and earlier a file named\n",[21,336,337],{},"proxy.ts"," is never run at all, \"so sessions never refresh and users get signed\nout\". An assistant working from the newest documentation can write exactly that\nfile into an older app.",[10,340,341,342,350,351,356],{},"Supabase's guide also says why this one is hard to find: \"it looks like users\nbeing signed out at random rather than an error in your code.\" The reports read\nthe same way. A developer on the\n",[55,343,346,349],{"href":344,"rel":345},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fssr\u002Fissues\u002F68",[59],[21,347,348],{},"@supabase\u002Fssr"," issue tracker"," wrote\n\"I'm inadvertently logged out of my web application every day\", and the Supabase\nengineer who answered pointed at how the middleware passed its response along.\nAn ",[55,352,355],{"href":353,"rel":354},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fsupabase-swift\u002Fissues\u002F486",[59],"iOS app's report","\ndescribes the logout coming \"2-3 days after logging in\", and was closed after\nupdates to Supabase's Swift library brought the reports down.",[260,358],{"alt":359,"caption":360,"src":361},"A browser sends its ticket to a server. The server trades it at the desk and gets a new one back. The response carrying the new ticket to the browser is broken off before it arrives, so the browser sends the old ticket again, and the desk refuses it as already used.","The server renewed the session, and the new ticket never made it back. The browser is still holding the one that was traded.","\u002Fblog\u002Fsupabase-users-logged-out\u002Fnew-ticket-lost-1600x640.png",[10,363,364,365,367],{},"To check, open your browser's developer tools on a page that renewed the\nsession and look at the response in the Network tab. It should carry a\n",[21,366,319],{}," with the new token, and the next request should send that token\nback.",[36,369,371],{"id":370},"cause-3-a-session-limit-in-your-auth-settings","Cause 3: a session limit in your Auth settings",[10,373,374],{},"On Pro plans and up, Supabase can end sessions on purpose, from the Sessions page\nof your project's Auth settings. There are three limits, and the sessions guide\ndescribes each:",[376,377,378,385,391],"ul",{},[379,380,381,384],"li",{},[31,382,383],{},"Time-boxed sessions"," end after a fixed time, however active the user is.",[379,386,387,390],{},[31,388,389],{},"An inactivity timeout"," ends a session that has not been renewed for a while.",[379,392,393,396],{},[31,394,395],{},"Single session per user"," keeps only the most recent sign-in, so signing in\non a phone ends the session on the laptop.",[10,398,399,400,403,404,406,407,409,410,412],{},"These say so in their own message, ",[21,401,402],{},"Session Expired",", with ",[21,405,188],{}," or\n",[21,408,192],{}," after it for the second and third. The guide adds\nthat ended sessions are deleted 24 hours later, so a ticket from one that comes\nback after that gets ",[21,411,245],{}," instead.",[10,414,415],{},"If you set one of these, the logouts are the setting working. If you did not\nmean to, or a template or an assistant did it for you, the page shows which\nlimit is on.",[36,417,419],{"id":418},"the-one-that-is-harmless","The one that is harmless",[10,421,422,423,425],{},"A ticket from a session that already ended, coming back from an old tab or a\nbrowser nobody opened for weeks, gets ",[21,424,66],{}," too. The person\nbehind it had already been signed out. Their browser asked once, Supabase said\nno, and they see your sign-in page, which is what they would have seen anyway.",[10,427,428],{},"It looks like this in a log: one line for one user, often soon after that user\nsigned out somewhere, and then nothing more for them. Lines like that are the\nerror doing its job. The ones to chase are the same people over and over, or a\nburst of different people on the same day.",[36,430,432],{"id":431},"how-to-read-your-auth-logs-for-this","How to read your auth logs for this",[10,434,435,436,439,440,443,444,447,448,451],{},"Open ",[31,437,438],{},"Logs"," in your Supabase dashboard, choose the ",[31,441,442],{},"Auth"," log type, and\nsearch the event messages for ",[21,445,446],{},"refresh token",". Select a row to see its details,\nincluding the user's ID, and the ",[31,449,450],{},"User"," filter then narrows the list to that\none person.\nHow far back the logs go depends on your plan, so read them while the complaints\nare recent.",[10,453,454],{},"Then read what repeats:",[127,456,457,467],{},[130,458,459],{},[133,460,461,464],{},[136,462,463],{},"What you see in the Auth log",[136,465,466],{},"What it points to",[146,468,469,480,490,503],{},[133,470,471,477],{},[151,472,473,474,476],{},"One ",[21,475,66],{}," for a user, and nothing after it",[151,478,479],{},"An old tab or a returning browser. Harmless.",[133,481,482,487],{},[151,483,484,486],{},[21,485,66],{}," for a user soon after they signed out elsewhere",[151,488,489],{},"Cause 1, a sign-out that ended every device",[133,491,492,500],{},[151,493,494,496,497,499],{},[21,495,236],{},", then ",[21,498,66],{}," a day later, for the same users, again and again",[151,501,502],{},"Cause 2, new tickets not reaching the browser",[133,504,505,510],{},[151,506,507,509],{},[21,508,402],{},", with a reason in brackets",[151,511,512],{},"Cause 3, a session limit",[10,514,515,516,519],{},"You can also ask the database how often people are signing in. Each sign-in adds\na row to ",[21,517,518],{},"auth.sessions",", and a sign-out deletes it. Paste this into the SQL\nEditor:",[14,521,524],{"className":522,"code":523,"language":19},[17],"select user_id, count(*) as sessions, max(created_at) as latest\nfrom auth.sessions\nwhere created_at > now() - interval '14 days'\ngroup by user_id\norder by sessions desc\nlimit 20;\n",[21,525,523],{"__ignoreMap":23},[10,527,528],{},"A user with far more sessions than they have devices has been signing in again\nand again without ever signing out, which is what somebody does when your app\nkeeps throwing them out.",[36,530,532],{"id":531},"what-not-to-change-while-you-fix-it","What not to change while you fix it",[10,534,535],{},"Your Row Level Security rules, reuse detection and the length of the access\ntoken. Each of the three looks like a fix and leaves the cause in place, and\nloosening the first can open your data to strangers.",[10,537,538,541,542,545,546,551,552,554,555,558,559,109],{},[31,539,540],{},"Leave your Row Level Security rules alone."," Row Level Security is the set of\nrules that decides which rows each visitor gets. While users are being thrown\nout, every screen whose rule reads ",[21,543,544],{},"auth.uid()"," comes up empty for them, because\n",[55,547,550],{"href":548,"rel":549},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fpostgres\u002Frow-level-security",[59],"Supabase's documentation","\nsays ",[21,553,544],{}," returns ",[21,556,557],{},"null"," when the session has expired. The tempting fix\nis to loosen that rule until the screen fills up again, and then it fills up for\nstrangers as well. If somebody has already done it, our free scan asks each table\nyour app names how many rows a visitor with no login would get, reads the count\nwithout fetching a single row, and takes about 20 seconds with no account:\n",[55,560,562],{"href":561},"\u002Fsecurity-scanner","scan your app",[10,564,565,568,569,571],{},[31,566,567],{},"Leave reuse detection on."," Supabase lets you turn it off, under the\nadvanced settings on the Sessions page, and calls doing so \"generally not\nrecommended\". With it off, cause 2 stops producing ",[21,570,236],{}," and the new\nticket still never reaches the browser.",[10,573,574,577],{},[31,575,576],{},"Keep the access token at an hour."," A longer wristband delays the logout and\nleaves its cause in place. Supabase's guide says that setting it over an hour is\n\"generally discouraged for security reasons\".",[36,579,581],{"id":580},"keeping-sign-ins-working-after-the-fix","Keeping sign-ins working after the fix",[10,583,584],{},"Two things can still go wrong once the logouts stop: a later change brings them\nback, and a rule loosened along the way leaves a table open to strangers.",[10,586,587],{},[31,588,589,593],{},[55,590,592],{"href":591},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking from outside:",[376,595,596,599,602,609],{},[379,597,598],{},"whether your app is up, checked every minute, so a wave of \"I got logged out\" messages is not mistaken for an outage",[379,600,601],{},"the full security check every hour, on up to three apps",[379,603,604,605,608],{},"a message when a result ",[31,606,607],{},"changes",", so a rule loosened during a fix does not wait for you to look",[379,610,611],{},"a monthly report, in plain language, of what it saw",[10,613,614],{},[31,615,616,620],{},[55,617,619],{"href":618},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database:",[376,622,623,626,629,632,635,638],{},[379,624,625],{},"an encrypted copy on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[379,627,628],{},"the auth schema your users' accounts live in, so they come back with everything else",[379,630,631],{},"each copy verified before it counts, by counting the rows in every table",[379,633,634],{},"your uploaded files as well, once you connect a Storage credential",[379,636,637],{},"a one-click restore, with a safety copy of the current state taken first",[379,639,640],{},"everything Monitor does",[36,642,644],{"id":643},"what-to-do-now","What to do now",[646,647,648],"key-takeaways",{},[376,649,650,656,662,668,671,674],{},[379,651,652,653,655],{},"Search your Auth logs for ",[21,654,446],{}," and read which message repeats, and for whom.",[379,657,658,659,109],{},"If a sign-out on one device ends the others, change it to ",[21,660,661],{},"signOut({ scope: 'local' })",[379,663,664,665,667],{},"If your app renders on a server, make sure the response that renewed a session is the one that reaches the browser, and check for its ",[21,666,319],{}," in the Network tab.",[379,669,670],{},"Look at the Sessions page of your Auth settings for a time box, an inactivity timeout or single session per user that nobody meant to turn on.",[379,672,673],{},"Leave Row Level Security, reuse detection and the access token's length as they are while you fix it.",[379,675,676,677,679],{},"Treat one ",[21,678,245],{}," per user as noise, and the same users every day as a bug.",[10,681,682,683,685],{},"Start with the Auth log, because the message that repeats tells you which of the\nthree causes you have. Then, once people stay signed in,\n",[55,684,562],{"href":561}," to check that nothing was loosened along the\nway.",{"title":23,"searchDepth":687,"depth":687,"links":688},3,[689,691,692,693,694,695,696,697,698,699,700],{"id":38,"depth":690,"text":39},2,{"id":112,"depth":690,"text":113},{"id":226,"depth":690,"text":227},{"id":267,"depth":690,"text":268},{"id":312,"depth":690,"text":313},{"id":370,"depth":690,"text":371},{"id":418,"depth":690,"text":419},{"id":431,"depth":690,"text":432},{"id":531,"depth":690,"text":532},{"id":580,"depth":690,"text":581},{"id":643,"depth":690,"text":644},"Security basics","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcover-1200x630.png","A ticket torn in two, its left half lit and its right half drained and falling away, in front of a row of whole tickets.","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.",false,"md",[708,711,714,717,720],{"q":709,"a":710},"Why do my Supabase users get logged out randomly?","Because the session behind their refresh token ended, and the access token they still hold keeps them signed in for up to an hour, so the logout arrives later than its cause. The usual reasons are a sign-out on another device, a renewed token that never reached the browser, and a session limit in your Auth settings. The auth log shows which one.",{"q":712,"a":713},"What is a refresh token?","It is the long-lived half of a Supabase session. The access token proves who the user is for an hour by default, and before it runs out your app trades the refresh token for a new pair. Each refresh token works once, and the old one stops working ten seconds after it is traded.",{"q":715,"a":716},"Is \"Refresh Token Not Found\" a sign of an attack?","On its own, no. It means Supabase Auth refused a token it has no record of, which is the correct answer. The protection against a stolen token is reuse detection, which ends a session when an old token comes back, and Supabase recommends leaving it switched on.",{"q":718,"a":719},"Why does it only happen in production?","Because most of the causes need time or a second device. A stale token is refused as already used on the first day and as not found once its record is cleared a day later, and a session you sign into while building rarely lives that long. Real users also sign in on several devices, which is where a sign-out that ends every session shows up.",{"q":721,"a":722},"How long does a Supabase session last?","Until the user signs out, by default. The access token lasts an hour unless you change it, and the refresh token never expires but works only once. On Pro plans and up you can limit sessions by total time, by inactivity, or to one per user, on the Sessions page of your Auth settings.","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",[725,726,70,727,728,729,730],"invalid refresh token refresh token not found","supabase invalid refresh token","supabase users logged out randomly","supabase refresh token already used","supabase session expired","supabase ssr refresh token error",{},true,"\u002Fblog\u002Fsupabase-users-logged-out","2026-10-19",{"title":5,"description":704},"blog\u002Fsupabase-users-logged-out",[738,739,740],"Supabase \"Invalid Refresh Token: Refresh Token Not Found\" means Supabase Auth has no record of the refresh token your app sent, so the session cannot be renewed and the user is signed out.","Three things remove that record: a sign-out (which in JavaScript ends every device by default), a used token sent a second time, and a session limit in your Auth settings.","Some of it is a harmless line from an old tab. Some of it signs every user out every day. The auth log tells you which, and each cause has its own fix.","4N2wrrWKxUz8pGxeILL_FK8uQS2mBghSU4EGb3xVGNs",[743,749,755,761,767,773,779,785,791,797,803,810,816,821,827,833,839,845,851,857,863,869,870,876,882,887,893,899,905,911,917,923,929,935,941,947,953,959,965,971,976,982,988,994,1000,1006,1011,1017,1023,1029,1035,1041,1047,1053,1059,1065,1071,1077,1083,1089,1095,1101,1107,1113,1119,1125,1131,1137,1143,1149,1155,1161,1167,1173,1179,1185,1191,1197,1203,1209,1215,1221,1227,1233,1238,1244,1250,1256,1261,1267],{"path":744,"title":745,"description":746,"published":747,"category":701,"image":748,"draft":705},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":750,"title":751,"description":752,"published":753,"category":701,"image":754,"draft":705},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":756,"title":757,"description":758,"published":759,"category":701,"image":760,"draft":705},"\u002Fblog\u002Fviolates-foreign-key-constraint","\"violates foreign key constraint\" on insert in Supabase","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.","2026-11-07","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",{"path":762,"title":763,"description":764,"published":765,"category":701,"image":766,"draft":705},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":768,"title":769,"description":770,"published":771,"category":701,"image":772,"draft":705},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":774,"title":775,"description":776,"published":777,"category":701,"image":778,"draft":705},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":780,"title":781,"description":782,"published":783,"category":701,"image":784,"draft":705},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":786,"title":787,"description":788,"published":789,"category":701,"image":790,"draft":705},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":792,"title":793,"description":794,"published":795,"category":701,"image":796,"draft":705},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":798,"title":799,"description":800,"published":801,"category":701,"image":802,"draft":705},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":804,"title":805,"description":806,"published":807,"category":808,"image":809,"draft":705},"\u002Fblog\u002Fdatabase-error-deleting-user","\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":811,"title":812,"description":813,"published":814,"category":701,"image":815,"draft":705},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":107,"title":817,"description":818,"published":819,"category":701,"image":820,"draft":705},"\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":822,"title":823,"description":824,"published":825,"category":701,"image":826,"draft":705},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":828,"title":829,"description":830,"published":831,"category":701,"image":832,"draft":705},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":834,"title":835,"description":836,"published":837,"category":701,"image":838,"draft":705},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":840,"title":841,"description":842,"published":843,"category":701,"image":844,"draft":705},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":846,"title":847,"description":848,"published":849,"category":701,"image":850,"draft":705},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":852,"title":853,"description":854,"published":855,"category":701,"image":856,"draft":705},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":858,"title":859,"description":860,"published":861,"category":701,"image":862,"draft":705},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":864,"title":865,"description":866,"published":867,"category":701,"image":868,"draft":705},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":733,"title":5,"description":704,"published":734,"category":701,"image":723,"draft":705},{"path":871,"title":872,"description":873,"published":874,"category":701,"image":875,"draft":705},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":877,"title":878,"description":879,"published":880,"category":701,"image":881,"draft":705},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":98,"title":883,"description":884,"published":885,"category":701,"image":886,"draft":705},"Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":888,"title":889,"description":890,"published":891,"category":701,"image":892,"draft":705},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":894,"title":895,"description":896,"published":897,"category":701,"image":898,"draft":705},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":900,"title":901,"description":902,"published":903,"category":701,"image":904,"draft":705},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":906,"title":907,"description":908,"published":909,"category":701,"image":910,"draft":705},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":912,"title":913,"description":914,"published":915,"category":701,"image":916,"draft":705},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":918,"title":919,"description":920,"published":921,"category":701,"image":922,"draft":705},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":924,"title":925,"description":926,"published":927,"category":701,"image":928,"draft":705},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":930,"title":931,"description":932,"published":933,"category":701,"image":934,"draft":705},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":936,"title":937,"description":938,"published":939,"category":701,"image":940,"draft":705},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":942,"title":943,"description":944,"published":945,"category":701,"image":946,"draft":705},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":948,"title":949,"description":950,"published":951,"category":701,"image":952,"draft":705},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":954,"title":955,"description":956,"published":957,"category":701,"image":958,"draft":705},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":960,"title":961,"description":962,"published":963,"category":701,"image":964,"draft":705},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":966,"title":967,"description":968,"published":969,"category":701,"image":970,"draft":705},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":221,"title":972,"description":973,"published":974,"category":701,"image":975,"draft":705},"Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":977,"title":978,"description":979,"published":980,"category":701,"image":981,"draft":705},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":983,"title":984,"description":985,"published":986,"category":701,"image":987,"draft":705},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":989,"title":990,"description":991,"published":992,"category":808,"image":993,"draft":705},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":995,"title":996,"description":997,"published":998,"category":808,"image":999,"draft":705},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":1001,"title":1002,"description":1003,"published":1004,"category":808,"image":1005,"draft":705},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":1007,"title":1008,"description":1009,"published":1004,"category":701,"image":1010,"draft":705},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":1012,"title":1013,"description":1014,"published":1015,"category":701,"image":1016,"draft":705},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":1018,"title":1019,"description":1020,"published":1021,"category":701,"image":1022,"draft":705},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":1024,"title":1025,"description":1026,"published":1027,"category":808,"image":1028,"draft":705},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":1030,"title":1031,"description":1032,"published":1033,"category":701,"image":1034,"draft":705},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":1036,"title":1037,"description":1038,"published":1039,"category":701,"image":1040,"draft":705},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":1042,"title":1043,"description":1044,"published":1045,"category":701,"image":1046,"draft":705},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":1048,"title":1049,"description":1050,"published":1051,"category":701,"image":1052,"draft":705},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":1054,"title":1055,"description":1056,"published":1057,"category":701,"image":1058,"draft":705},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":1060,"title":1061,"description":1062,"published":1063,"category":701,"image":1064,"draft":705},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1066,"title":1067,"description":1068,"published":1069,"category":701,"image":1070,"draft":705},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1072,"title":1073,"description":1074,"published":1075,"category":701,"image":1076,"draft":705},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1078,"title":1079,"description":1080,"published":1081,"category":808,"image":1082,"draft":705},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1084,"title":1085,"description":1086,"published":1087,"category":808,"image":1088,"draft":705},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1090,"title":1091,"description":1092,"published":1093,"category":808,"image":1094,"draft":705},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1096,"title":1097,"description":1098,"published":1099,"category":701,"image":1100,"draft":705},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":1102,"title":1103,"description":1104,"published":1105,"category":701,"image":1106,"draft":705},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1108,"title":1109,"description":1110,"published":1111,"category":701,"image":1112,"draft":705},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1114,"title":1115,"description":1116,"published":1117,"category":701,"image":1118,"draft":705},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1120,"title":1121,"description":1122,"published":1123,"category":701,"image":1124,"draft":705},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1126,"title":1127,"description":1128,"published":1129,"category":701,"image":1130,"draft":705},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1132,"title":1133,"description":1134,"published":1135,"category":701,"image":1136,"draft":705},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1138,"title":1139,"description":1140,"published":1141,"category":701,"image":1142,"draft":705},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1144,"title":1145,"description":1146,"published":1147,"category":701,"image":1148,"draft":705},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1150,"title":1151,"description":1152,"published":1153,"category":701,"image":1154,"draft":705},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1156,"title":1157,"description":1158,"published":1159,"category":808,"image":1160,"draft":705},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1162,"title":1163,"description":1164,"published":1165,"category":701,"image":1166,"draft":705},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1168,"title":1169,"description":1170,"published":1171,"category":808,"image":1172,"draft":705},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1174,"title":1175,"description":1176,"published":1177,"category":701,"image":1178,"draft":705},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1180,"title":1181,"description":1182,"published":1183,"category":701,"image":1184,"draft":705},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1186,"title":1187,"description":1188,"published":1189,"category":701,"image":1190,"draft":705},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1192,"title":1193,"description":1194,"published":1195,"category":701,"image":1196,"draft":705},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1198,"title":1199,"description":1200,"published":1201,"category":808,"image":1202,"draft":705},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1204,"title":1205,"description":1206,"published":1207,"category":808,"image":1208,"draft":705},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1210,"title":1211,"description":1212,"published":1213,"category":701,"image":1214,"draft":705},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1216,"title":1217,"description":1218,"published":1219,"category":701,"image":1220,"draft":705},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1222,"title":1223,"description":1224,"published":1225,"category":808,"image":1226,"draft":705},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1228,"title":1229,"description":1230,"published":1231,"category":701,"image":1232,"draft":705},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1234,"title":1235,"description":1236,"published":1231,"category":701,"image":1237,"draft":705},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1239,"title":1240,"description":1241,"published":1242,"category":701,"image":1243,"draft":705},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1245,"title":1246,"description":1247,"published":1248,"category":808,"image":1249,"draft":705},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1251,"title":1252,"description":1253,"published":1254,"category":701,"image":1255,"draft":705},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1257,"title":1258,"description":1259,"published":1254,"category":808,"image":1260,"draft":705},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1262,"title":1263,"description":1264,"published":1265,"category":808,"image":1266,"draft":705},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":89,"title":1268,"description":1269,"published":1265,"category":701,"image":1270,"draft":705},"Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]