[{"data":1,"prerenderedAt":1198},["ShallowReactive",2],{"blog-en-vibe-coding-security-scanners-compared":3,"blog-index-en":955},{"id":4,"title":5,"body":6,"category":908,"cover":909,"coverAlt":910,"description":911,"draft":912,"extension":913,"faq":914,"image":933,"keywords":934,"meta":943,"navigation":944,"ogTitle":945,"path":946,"published":947,"seo":948,"stem":949,"tldr":950,"updated":947,"__hash__":954},"blog_en\u002Fblog\u002Fvibe-coding-security-scanners-compared.md","Vibe coding security scanners compared, including ours",{"type":7,"value":8,"toc":892},"minimark",[9,13,16,24,37,42,45,51,63,69,77,83,87,90,276,279,282,286,289,420,423,427,430,433,444,451,466,471,474,477,480,483,491,495,498,501,509,515,519,522,706,714,717,728,732,735,756,759,763,766,781,784,804,807,811,814,850,854,877],[10,11,12],"p",{},"You typed \"best vibe coding security scanner\" into a search box, and the first\ncomparison that came back was written by one of the scanners. The disclosure was\nthere, in a line under the table.",[10,14,15],{},"Reeve is one of the ten tools below, so this page has the same problem. Reeve is\na free security scanner that reads a live URL in about twenty seconds with no\naccount, and a paid subscription that keeps watching the app afterwards and keeps\na verified copy of its database. What we can do about the conflict is show the\nworking. Every row was read off each tool's own site on 7 September 2026, every\nprice is printed including ours, nothing here is a paid placement, and there is a\nsection near the end naming the three jobs on this page Reeve does not do at all.",[10,17,18,19,23],{},"Here is what the vendor comparisons leave out. ",[20,21,22],"strong",{},"Most of these tools read the\nsame surface."," They load your live app, pull down the JavaScript it ships to a\nbrowser, read the headers that came with it, ask your database a question any\nstranger could ask, and write down what answered. The scan is the part they have\nin common. Three questions separate them:",[25,26,27,31,34],"ol",{},[28,29,30],"li",{},"Can it tell a key that belongs in your app from one that does not?",[28,32,33],{},"Does it say so when a check got no answer?",[28,35,36],{},"Does anything happen on the day your data is actually gone?",[38,39,41],"h2",{"id":40},"which-vibe-coding-security-scanner-is-best","Which vibe coding security scanner is best?",[10,43,44],{},"The one that can read the surface your problem is on. That question sorts this\nlist faster than any feature list will, and it splits ten tools into three\ngroups.",[10,46,47,50],{},[20,48,49],{},"Tools you hand a URL."," SafeToShip, LaunchGuard, Vibe App Scanner, VibeEval,\nSupaExplorer and Reeve. You paste an address, they load your app the way a\nvisitor would, and a report comes back inside a minute or two. Nothing to\ninstall, no account to connect, no access to anything you own.",[10,52,53,56,57,62],{},[20,54,55],{},"Tools you hand your code."," CheckVibe reads a live URL and will also connect to\na GitHub repository if you let it. Reading source answers questions a URL scan\ncannot ask, and it carries a blind spot of its own, which is why\n",[58,59,61],"a",{"href":60},"\u002Fblog\u002Fvibe-coding-security-scanner","what a URL scan misses"," is worth reading\nbefore you pay for either kind.",[10,64,65,68],{},[20,66,67],{},"Tools you hand your Supabase account."," Supabase's own Security Advisor sits in\nyour dashboard and reads the project's configuration. Defencecore asks for\nread-only access to one project's logs and then watches them. Supabomb is an\nopen-source command line tool written for people who do this professionally. All\nthree reach things from inside the account that nothing standing outside your app\ncan see.",[10,70,71,72,76],{},"If you are on Supabase and have never opened the Security Advisor, open that\nbefore you pay anybody on this page. It is free, it runs on its own, and it\nemails the project owner when a table shows up with row level security switched\noff. It is also not a competitor to anything here: it reads your configuration,\nwhere a scan reads what your configuration is doing to strangers, and\n",[58,73,75],{"href":74},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","those two come apart"," more often\nthan anyone expects.",[78,79],"diagram",{"alt":80,"caption":81,"src":82},"A three by three grid. Each row opens with what a tool is handed: a globe, a pair of angle brackets, a key. Each column is a surface it could read: an app pane, source code, a database beside a storage bucket. One cell in each row is lit and the other two are dashed outlines, so the lit cells fall along the diagonal.","What each kind of tool is given, and what that lets it read. One tool on this page buys two of these rows. Nothing buys all three.","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fwhat-you-hand-it-1600x700.png",[38,84,86],{"id":85},"what-does-each-scanner-actually-read","What does each scanner actually read?",[10,88,89],{},"Seven of the ten will run on nothing but a URL. The other three want something\nyou have to log in to hand over, and that is the column to read before any\nfeature list. The two on the right are the ones that decide whether you can try\na tool this morning: five will scan for you with no account at all, and four of\nthose five show you the whole report.",[91,92,93,115],"table",{},[94,95,96],"thead",{},[97,98,99,103,106,109,112],"tr",{},[100,101,102],"th",{},"Tool",[100,104,105],{},"What it reads",[100,107,108],{},"What you hand it",[100,110,111],{},"Scan without signing up",[100,113,114],{},"Full findings free",[116,117,118,136,153,170,186,200,215,229,246,262],"tbody",{},[97,119,120,124,127,130,133],{},[121,122,123],"td",{},"Supabase Security Advisor",[121,125,126],{},"Your project's own configuration",[121,128,129],{},"Your Supabase login",[121,131,132],{},"It is your own account",[121,134,135],{},"Yes",[97,137,138,141,144,147,150],{},[121,139,140],{},"CheckVibe",[121,142,143],{},"Your live app, and your repository if you connect one",[121,145,146],{},"A URL, and GitHub if you want",[121,148,149],{},"No, its button is \u002Fsignup",[121,151,152],{},"No, a paid plan unlocks",[97,154,155,158,161,164,167],{},[121,156,157],{},"Defencecore",[121,159,160],{},"Your Supabase logs",[121,162,163],{},"Read-only log access to one project",[121,165,166],{},"No, it wants a trial",[121,168,169],{},"No",[97,171,172,175,178,181,183],{},[121,173,174],{},"LaunchGuard",[121,176,177],{},"Your live app",[121,179,180],{},"A URL",[121,182,135],{},[121,184,185],{},"Yes, for what it scans",[97,187,188,191,193,195,197],{},[121,189,190],{},"Reeve",[121,192,177],{},[121,194,180],{},[121,196,135],{},[121,198,199],{},"No, an email first",[97,201,202,205,207,209,212],{},[121,203,204],{},"SafeToShip",[121,206,177],{},[121,208,180],{},[121,210,211],{},"Yes, \"no account needed\"",[121,213,214],{},"No, $9 or a plan",[97,216,217,220,223,225,227],{},[121,218,219],{},"SupaExplorer",[121,221,222],{},"Your live app, or a project you connect",[121,224,180],{},[121,226,135],{},[121,228,135],{},[97,230,231,234,237,240,243],{},[121,232,233],{},"Supabomb",[121,235,236],{},"Your Supabase project, from a command line",[121,238,239],{},"Credentials you supply yourself",[121,241,242],{},"You run it yourself",[121,244,245],{},"Yes, it is open source",[97,247,248,251,254,256,259],{},[121,249,250],{},"Vibe App Scanner",[121,252,253],{},"Your live app, signed in on the top plan",[121,255,180],{},[121,257,258],{},"Its page does not say",[121,260,261],{},"No, one scan in part",[97,263,264,267,270,272,274],{},[121,265,266],{},"VibeEval",[121,268,269],{},"Your live app, including pages behind a login",[121,271,180],{},[121,273,166],{},[121,275,169],{},[10,277,278],{},"Every row was read off each tool's own pages on 7 September 2026. This is a young\ncategory and the pages move, so treat the row as older than the site it came\nfrom.",[10,280,281],{},"That table is where most comparisons stop, and it is the part that separates\nthese tools least.",[38,283,285],{"id":284},"the-three-questions-tool-by-tool","The three questions, tool by tool",[10,287,288],{},"Reeve is the only one of the ten that answers yes to all three.",[91,290,291,306],{},[94,292,293],{},[97,294,295,297,300,303],{},[100,296,102],{},[100,298,299],{},"Tells a publishable key from a secret one",[100,301,302],{},"Says when a check got no answer",[100,304,305],{},"Can put your data back",[116,307,308,321,331,342,352,362,372,383,394,404],{},[97,309,310,312,315,318],{},[121,311,190],{},[121,313,314],{},"Yes, it decodes the key's role",[121,316,317],{},"Yes, it prints \"Couldn't check\"",[121,319,320],{},"Yes, on a subscription",[97,322,323,325,327,329],{},[121,324,140],{},[121,326,258],{},[121,328,258],{},[121,330,169],{},[97,332,333,335,338,340],{},[121,334,157],{},[121,336,337],{},"Not what it does",[121,339,258],{},[121,341,169],{},[97,343,344,346,348,350],{},[121,345,174],{},[121,347,258],{},[121,349,258],{},[121,351,169],{},[97,353,354,356,358,360],{},[121,355,204],{},[121,357,258],{},[121,359,258],{},[121,361,169],{},[97,363,364,366,368,370],{},[121,365,219],{},[121,367,258],{},[121,369,258],{},[121,371,169],{},[97,373,374,376,378,381],{},[121,375,123],{},[121,377,337],{},[121,379,380],{},"Not applicable, it is inside",[121,382,169],{},[97,384,385,387,390,392],{},[121,386,233],{},[121,388,389],{},"You would read the source",[121,391,389],{},[121,393,169],{},[97,395,396,398,400,402],{},[121,397,250],{},[121,399,258],{},[121,401,258],{},[121,403,169],{},[97,405,406,408,416,418],{},[121,407,266],{},[121,409,410,411,415],{},"Listed a ",[412,413,414],"code",{},"pk_live_"," key as CRIT",[121,417,258],{},[121,419,169],{},[10,421,422],{},"\"Its page does not say\" is what it says. We can read what these tools publish\nabout themselves; we cannot see the report yours would get. The three sections\nbelow explain each column and give you a way to test it on your own app, by\nscanning it with two of these tools and reading the two reports side by side.",[38,424,426],{"id":425},"can-it-tell-your-safe-keys-from-your-dangerous-ones","Can it tell your safe keys from your dangerous ones?",[10,428,429],{},"Reeve can, by decoding the key and reading the role written inside it. That\nsingle capability is the difference between a report you can act on and a list of\nforty things you learn to scroll past.",[10,431,432],{},"Start with why the counts differ so much. A check count is a marketing number\nrather than a measurement: CheckVibe advertises over a hundred, Reeve runs nine\nand publishes how often each of the nine ever fires across 30,998 apps. A longer\nlist about the same app is a longer list. The bigger cause is that some scanners\ntreat every key they find in your JavaScript as a problem, and some of those keys\nare supposed to be there.",[10,434,435,436,438,439,443],{},"Your Supabase publishable key belongs in your frontend. So does a Stripe key\nbeginning ",[412,437,414],{},". Both travel to every visitor by design, because the request\nthey identify is made from the visitor's browser, and neither one grants anything\non its own.\n",[58,440,442],{"href":441},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which keys are safe in your frontend","\nis the whole of that distinction.",[10,445,446,447,450],{},"On 7 September 2026, VibeEval's homepage listed \"Stripe pk_live_ found in\n",[412,448,449],{},"\u002Fassets\u002Fapp.js","\" among five example findings, marked CRIT. That is a publishable\nkey, sitting in the place Stripe publishes it to. We cannot see the reports any\nof these tools send their real customers, so read that as one marketing page\nrather than as a verdict on the product. It is a clean example of the thing to\ntest for, and the damage is not the one wrong line. A scanner that hands you a\ncritical finding for having done something right teaches you to shrug at the next\none, and the next one is the real finding.",[10,452,453,454,457,458,461,462,465],{},"An older Supabase key is a JWT, and its middle section states ",[412,455,456],{},"\"role\": \"anon\""," or\n",[412,459,460],{},"\"role\": \"service_role\""," in readable text. Reeve reads that word. A publishable\nkey in your bundle comes back under a heading saying you got this right, costing\nyou nothing, and a ",[412,463,464],{},"service_role"," key in the same bundle is the worst thing the\nscanner knows how to find. Those two look nearly identical in the Supabase\ndashboard, sitting next to each other, which is how the wrong one ends up copied.",[78,467],{"alt":468,"caption":469,"src":470},"Two report panels for one app. The left panel has eight rows, every one carrying a red cross, including a row labelled pk_live_. The right panel has four rows: pk_live_ beside a green tick, one red cross, one amber cross, and a fourth row whose mark is an empty dashed slot.","One app, two reports. The row that matters is the publishable key, and the last row on the right is a check that got no answer, drawn as no answer.","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fsame-app-two-reports-1600x760.png",[38,472,33],{"id":473},"does-it-say-so-when-a-check-got-no-answer",[10,475,476],{},"Reeve does, in those words. A check ends three ways and only one of them is a\npass: it finds something, it gets a clear no, or it gets nothing at all because\nthe request timed out, the host refused it, or the page never finished loading.\nThat third ending is the empty slot on the right of the picture above. It prints\nas \"Couldn't check\" and it leaves your grade alone.",[10,478,479],{},"This is the quietest thing on the page and the one that decides whether a report\nis worth anything, because a probe that got no answer looks exactly like a probe\nthat came back clean once somebody has rounded it up to a tick. You would act on\nthat tick. There is nothing behind it.",[10,481,482],{},"We went looking for the same promise on the other nine sites on 7 September 2026\nand did not find it made anywhere. That is not evidence that any of them round\nup. It is a claim none of them puts in writing, and it is the one we would want\nin writing before believing a green report about an app we cared about.",[10,484,485,486,490],{},"The same rule governs the numbers Reeve publishes about everyone else. Between 12\nand 14 August 2026 we ran all nine checks over\n",[58,487,489],{"href":488},"\u002Fresearch\u002Fvibe-coded-app-security-2026","30,998 live vibe-coded apps"," built on\nLovable, Bolt, v0, Cursor, Replit, Windsurf and Base44, released every aggregate\nunder CC BY 4.0 so anyone can reuse it, and wrote down how often each check\nfired, what share of apps it could not reach, and how those were counted. A check\nthat got no answer sits in its own column rather than in the clean pile, so\nnothing on that page is inflated by counting silence as safety. LaunchGuard's\nhomepage publishes 96 apps tested and 2.37 million exposed records. None of the\nother eight sites we read published a figure at all.",[38,492,494],{"id":493},"what-happens-on-the-day-your-data-is-gone","What happens on the day your data is gone?",[10,496,497],{},"Nothing, on nine of the ten. A scanner finds the open door. It cannot tell you\nwho already walked through it, and it cannot return a table somebody emptied on\nTuesday.",[10,499,500],{},"Reeve Care is the tenth, and closing that gap is why this company exists. It\ntakes copies of your Supabase database on a schedule, opens each copy and counts\nit against what went in before the copy counts as a backup, holds them outside\nyour Supabase account so a suspended project or a login you cannot recover leaves\nthem where they are, and replaces your data from one when you ask. A copy of the\ncurrent state is taken first, before anything is replaced.",[10,502,503,504,508],{},"Your uploaded files travel with the rows once you connect a Storage credential,\nwhich is a second key asked for separately and the only one Reeve holds that can\nwrite, because Supabase issues no read-only key for files.\n",[58,505,507],{"href":506},"\u002Fsupabase-backups","What that actually does"," is drawn out on the backups page.",[10,510,511,514],{},[20,512,513],{},"Supabase is the only thing Care can back up",", so if your data lives in\nFirebase or somewhere else, this whole section is not available to you and the\nscanning half is what Reeve has to offer. Vibe App Scanner and SafeToShip both\ncheck Firebase security rules, which is the nearest equivalent on this page.",[38,516,518],{"id":517},"what-do-you-get-for-a-monthly-subscription","What do you get for a monthly subscription?",[10,520,521],{},"On nine of the ten, more scans. On Reeve, the scans plus what happens after one\nof them finds something.",[523,524,525],"comparison-table",{},[91,526,527,542],{},[94,528,529],{},[97,530,531,533,536,539],{},[100,532],{},[100,534,535],{},"A scanner subscription",[100,537,538],{},"Reeve Monitor",[100,540,541],{},"Reeve Care",[116,543,544,557,570,582,594,608,620,631,643,655,666,679,692],{},[97,545,546,549,552,555],{},[121,547,548],{},"Re-scans on a schedule",[121,550,551],{},"Yes, on the paid tiers",[121,553,554],{},"Hourly",[121,556,554],{},[97,558,559,562,565,568],{},[121,560,561],{},"Uptime checks",[121,563,564],{},"CheckVibe, at 60 seconds",[121,566,567],{},"Every 60 seconds",[121,569,567],{},[97,571,572,575,578,580],{},[121,573,574],{},"Alerts when something changes",[121,576,577],{},"On some",[121,579,135],{},[121,581,135],{},[97,583,584,587,590,592],{},[121,585,586],{},"A monthly report",[121,588,589],{},"Not on any we read",[121,591,135],{},[121,593,135],{},[97,595,596,599,602,605],{},[121,597,598],{},"Apps included",[121,600,601],{},"Varies",[121,603,604],{},"Three",[121,606,607],{},"One, five on Pro",[97,609,610,613,615,617],{},[121,611,612],{},"A copy of your database",[121,614,169],{},[121,616,169],{},[121,618,619],{},"Daily",[97,621,622,625,627,629],{},[121,623,624],{},"Read back before it counts",[121,626,169],{},[121,628,169],{},[121,630,135],{},[97,632,633,636,638,640],{},[121,634,635],{},"Restore points kept",[121,637,169],{},[121,639,169],{},[121,641,642],{},"30, 90 on Pro",[97,644,645,648,650,652],{},[121,646,647],{},"Your uploaded files",[121,649,169],{},[121,651,169],{},[121,653,654],{},"With a Storage key",[97,656,657,660,662,664],{},[121,658,659],{},"Putting it back is a button",[121,661,169],{},[121,663,169],{},[121,665,135],{},[97,667,668,671,674,676],{},[121,669,670],{},"What it can back up",[121,672,673],{},"Nothing",[121,675,673],{},[121,677,678],{},"Supabase only",[97,680,681,684,687,690],{},[121,682,683],{},"Free trial",[121,685,686],{},"7 to 14 days on some",[121,688,689],{},"7 days",[121,691,689],{},[97,693,694,697,700,703],{},[121,695,696],{},"Price when we read it",[121,698,699],{},"$24 to $49 a month",[121,701,702],{},"$12 a month",[121,704,705],{},"$49 a month",[10,707,708,709,713],{},"Those competing figures are what the five sellers publishing one were showing on\n7 September 2026: SafeToShip $24, Vibe App Scanner $29 or $49, VibeEval $49 with\na $149 team tier, Defencecore $29, and SupaExplorer lower at $6.75 behind a\ndiscount banner. CheckVibe and LaunchGuard publish no figure at all. Read the\ncurrent price on the seller's own page before you buy anything, and that includes\n",[58,710,712],{"href":711},"\u002Fpricing","ours",", which is sometimes below the list figure here and never above\nit.",[10,715,716],{},"Every paid plan here can be tried before it charges you. Reeve gives you seven\ndays, Defencecore seven, and VibeEval advertises fourteen with no card. The\nothers do not say on their pricing pages.",[10,718,719,720,723,724,727],{},"Two things fall out of that last row. ",[20,721,722],{},"Reeve Monitor is $12 a month"," for three\napps, below every paid tier here except a discounted one, and it is the whole\nwatching half: hourly re-scans, a 60-second uptime probe, alerts when something\nchanges, and a monthly report. And ",[20,725,726],{},"Reeve Care is $49 a month",", which is\nexactly what VibeEval Pro and Vibe App Scanner Pro charge, while being the only\nsubscription on the page that also holds a verified copy of your database and\nputs it back on request. Above that, Care Pro at $79 adds five apps, backups\ntwice a day and a public status page, and Care Max at $139 takes them four times\na day and sits under VibeEval's $149 team tier.",[38,729,731],{"id":730},"where-reeve-is-not-the-answer","Where Reeve is not the answer",[10,733,734],{},"Three jobs on this page that Reeve does not do at all.",[736,737,738,744,750],"ul",{},[28,739,740,743],{},[20,741,742],{},"Reading your source code."," CheckVibe will if you connect GitHub, and the\ndedicated secret scanners built for that job go deeper than either of us. It is\nalso the only way to find a key that left your app months ago and is still\nsitting in its history.",[28,745,746,749],{},[20,747,748],{},"Testing the app while signed in."," VibeEval drives a real browser through\nlogin screens, Vibe App Scanner runs authenticated scans on its top plan, and\nLaunchGuard's paid tier drives Claude Code through authorisation scenarios.\nReeve never signs in, never writes and never downloads a row, which is what\nmakes it safe to point at a production app with real customers on it, and which\nis also why a bug that only shows itself to a signed-in user is invisible to\nit.",[28,751,752,755],{},[20,753,754],{},"Being open, or being driven by your agent."," Supabomb is open source and\nwritten in Python. Vibe App Scanner publishes an MCP server, CheckVibe pulls\nits findings into Claude or Cursor, and Supabase's advisor is reachable through\nSupabase's own MCP server. Reeve publishes neither its source nor an MCP\nserver.",[10,757,758],{},"Where Reeve is the answer: your app is live, you want to know what it hands\nstrangers right now without connecting an account to anything, you want a report\nthat tells you what you got right as clearly as what is open, and you would like\nsomebody to be holding a verified copy of your database on the day it goes wrong.",[38,760,762],{"id":761},"what-are-you-handing-over-when-a-tool-reads-your-code","What are you handing over when a tool reads your code?",[10,764,765],{},"Standing access to everything in the repository, which is a much larger thing\nthan the app.",[10,767,768,769,772,773,776,777,780],{},"Your repository is not your app. It holds every key you ever committed and later\ntook out, the seed and fixture files with real-looking customer data in them, the\nhalf-finished branch nobody deployed, and the instructions you wrote for your AI\nbuilder. That last one surprises people. Your ",[412,770,771],{},"CLAUDE.md",", your ",[412,774,775],{},".cursorrules",",\nyour ",[412,778,779],{},"AGENTS.md",", the long prompt describing how the product is meant to behave:\nthat is your design thinking, in plain text, in the repository. A URL scan sees\nthe app your visitors see. A repository connection sees all of it, and a second\ncompany now holds a copy.",[10,782,783],{},"Three things to check before you grant one:",[736,785,786,792,798],{},[28,787,788,791],{},[20,789,790],{},"It is standing access, not a visit."," A GitHub App or an OAuth grant keeps\nworking until you go and revoke it, so it reads what you push next month too.\nFind out whether you can scope it to one repository, and find the revoke button\nbefore you need it.",[28,793,794,797],{},[20,795,796],{},"Their breach becomes your breach."," Whatever a vendor holds about you is\nexposed when the vendor is. Defencecore argues exactly this for itself on its\nown page, and the argument is a good one: a tool that only reads can \"never\nbecome the incident\".",[28,799,800,803],{},[20,801,802],{},"A tool that signs in can change things."," A scanner driving a browser through\nyour login is doing what a user does, on your live data. Read what it says it\nwill and will not click.",[10,805,806],{},"This is a trade rather than a warning. A repository scanner finds the key you\ndeleted in April and nothing reading your live site ever will, so if that is the\nquestion you have, the access is what it costs to answer it.",[38,808,810],{"id":809},"which-one-should-you-pick","Which one should you pick?",[10,812,813],{},"Five situations, and two of them do not end with us.",[736,815,816,826,832,838,844],{},[28,817,818,821,825],{},[20,819,820],{},"You want to know what your app shows strangers, right now, for free.",[58,822,824],{"href":823},"\u002Fsecurity-scanner","Reeve's scan"," or LaunchGuard. Neither asks you to sign up,\nand both come back inside a minute. SafeToShip and SupaExplorer will also scan\nwith no account.",[28,827,828,831],{},[20,829,830],{},"You are on Supabase and have never opened the Security Advisor."," That first,\nbefore anything on this page with a price on it. It is free and it reads what\nno outside scan can.",[28,833,834,837],{},[20,835,836],{},"You want your source code read, or the app tested while signed in."," CheckVibe\nfor the repository, VibeEval or Vibe App Scanner's top plan for behind the\nlogin. Read the section above on what that access costs before you grant it.",[28,839,840,843],{},[20,841,842],{},"You want the app watched and you are counting pennies."," Reeve Monitor, $12 a\nmonth for three apps: hourly re-scans, a 60-second uptime probe, alerts and a\nmonthly report, and no backups at all.",[28,845,846,849],{},[20,847,848],{},"You have real customers, and nobody who will be running a restore under\npressure."," Reeve Care, $49 a month, which is the scanning and the watching and\na verified copy of your database that goes back with one button. If your data\nis not in Supabase, the backup half does not apply to you.",[38,851,853],{"id":852},"what-to-do-this-week","What to do this week",[855,856,857],"key-takeaways",{},[736,858,859,862,865,868,871,874],{},[28,860,861],{},"Open your Supabase Security Advisor before you pay anybody. It is free, it is already in your dashboard, and it reads things no external scan can reach.",[28,863,864],{},"Run two free URL scanners over the same app and put the reports side by side. Where they disagree is where one of them is guessing.",[28,866,867],{},"Check what each one says about the publishable key in your bundle. A tool that marks that critical will mark everything critical, and you will learn to ignore all of it.",[28,869,870],{},"Read the lines saying a check could not run before the lines saying one passed. A report with no such line is not telling you there were none.",[28,872,873],{},"Before you connect a repository or a Supabase account to anything, check what the grant covers, whether it can be scoped to one project, and where the revoke button is.",[28,875,876],{},"Decide separately who is holding a copy of your database. Nine of the ten tools above stop at telling you, and the top scanner-only subscriptions cost the same as the one that does not.",[10,878,879,882,883,886,887,891],{},[58,880,881],{"href":823},"Reeve's free security scan"," reads a live URL in about twenty\nseconds with no account, grades what it found, and lists the things you got right\nbeside the things that are open. Watching an app afterwards starts at $12 a\nmonth, and backups with one-button restore at $49;\n",[58,884,885],{"href":711},"the plans are here",". If you would rather go through your app yourself\nfirst, ",[58,888,890],{"href":889},"\u002Fchecklist","the 10-minute security checklist"," is the same ground without\na tool in the way.",{"title":893,"searchDepth":894,"depth":894,"links":895},"",3,[896,898,899,900,901,902,903,904,905,906,907],{"id":40,"depth":897,"text":41},2,{"id":85,"depth":897,"text":86},{"id":284,"depth":897,"text":285},{"id":425,"depth":897,"text":426},{"id":473,"depth":897,"text":33},{"id":493,"depth":897,"text":494},{"id":517,"depth":897,"text":518},{"id":730,"depth":897,"text":731},{"id":761,"depth":897,"text":762},{"id":809,"depth":897,"text":810},{"id":852,"depth":897,"text":853},"Security basics","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcover-1200x630.png","A magnifier at the left sending arcs of sonar out across a scattered field of app windows, each arc fainter than the one before.","The best vibe coding security scanner comes down to three questions no feature list answers. Ten tools compared, with prices, and the jobs Reeve does not do.",false,"md",[915,918,921,924,927,930],{"q":916,"a":917},"Which vibe coding security scanner is free?","Several will scan without payment, and they mean different things by it. Supabase Security Advisor is free outright and lives in the dashboard you already log into. Five will scan with no account at all: Reeve, LaunchGuard, SupaExplorer, SafeToShip whose pricing page says \"no account needed\", and Supabomb because you run it on your own machine. Of those five, LaunchGuard, SupaExplorer and Supabomb also show the whole report free, while Reeve shows the grade, the score and the counts in about twenty seconds and asks for an email before the detailed findings, and SafeToShip charges $9 for them. CheckVibe sends you to a signup page, and VibeEval and Defencecore put the report behind a trial.",{"q":919,"a":920},"How much does a vibe coding security scanner cost?","Between $24 and $49 a month on the five that published a figure when we read them on 7 September 2026: SafeToShip $24, Vibe App Scanner $29 or $49, VibeEval $49 with a $149 team tier, Defencecore $29, and SupaExplorer lower at $6.75 behind a discount banner. Reeve Monitor is $12 a month for hourly re-scans, 60-second uptime checks, alerts and a monthly report across three apps, which is below every paid tier above except the discounted one. Reeve Care is $49, the same as the top scanner tiers charge, and it adds daily backups of your Supabase database that are read back before they count, with one-button restore. Check every figure on the seller page before you buy, ours included.",{"q":922,"a":923},"Do any of them need my database password?","None of the URL scanners do, Reeve included. They read your app from outside, so there is nothing to connect. Defencecore asks you to authorise read-only access to one Supabase project, which is an account permission and not your password. Supabase Security Advisor needs your Supabase login because it is part of Supabase. Supabomb is a command line tool you run yourself, so what it asks for is up to you.",{"q":925,"a":926},"Which ones detect Supabase RLS problems?","Most of this list claims to, and they find different things. A URL scanner such as Reeve asks your project whether an anonymous request gets rows back, which is the consequence, and reads the count off a response header without fetching a row. Supabase Security Advisor reads the configuration and reports tables with row level security switched off or left without a policy, which is the cause. The two come apart more often than you would expect, so a clean advisor and a scanner finding rows in the same table is not a contradiction.",{"q":928,"a":929},"Why does one tool say I have 40 issues and another says 2?","Because they are counting with different rulers. Tools advertise anywhere from nine checks to over a hundred, and a longer list produces a longer report on an identical app. The bigger cause is that some scanners treat every key they find in your JavaScript as a problem, including the publishable keys that are supposed to be there. Reeve decodes the key and reads the role inside it, so a publishable key comes back as something you got right rather than as a finding. Look at what a tool says about your Supabase publishable key before you believe its total.",{"q":931,"a":932},"Is this comparison biased?","Yes. Reeve is one of the ten tools in the table and we make it, so read the page with that in hand. What we have done about it is name the three jobs on this page Reeve does not do at all, point you at the free tool in your own Supabase dashboard before any of the paid ones, print the competing prices next to our own, and publish the whole dataset behind our checks under an open licence so the claims can be audited. Every row was read off each tool page on 7 September 2026 and none of them are linked, so nothing here is a paid placement.","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",[935,936,937,938,939,940,941,942],"best vibe coding security scanner","vibe coding security scanner comparison","checkvibe alternative","vibe app scanner alternative","launchguard alternative","supabase security scanner comparison","free vs paid app security scanner","AI app security tools 2026",{},true,"Vibe coding security scanners compared","\u002Fblog\u002Fvibe-coding-security-scanners-compared","2026-09-07",{"title":5,"description":911},"blog\u002Fvibe-coding-security-scanners-compared",[951,952,953],"There is no single best vibe coding security scanner, because most of them read the same surface and differ in what they do with it. Seven of the ten here run on nothing but a URL.","Three questions separate them: whether a tool can tell a key that belongs in your app from one that does not, whether it says so when a check got no answer, and whether anything puts your data back afterwards.","Reeve answers yes to all three, at $12 a month to watch an app and $49 to back it up, which is what the top scanner-only subscriptions here charge to do neither. We make it, so the jobs Reeve does not do at all are named near the end.","Q4hjalD62elFfrdNhrDlsiUq9HZCFePrW4dZYJyxgAU",[956,963,969,975,981,987,993,999,1005,1011,1017,1023,1029,1035,1041,1047,1053,1054,1060,1065,1071,1077,1083,1089,1095,1101,1107,1113,1119,1125,1131,1137,1143,1149,1155,1161,1166,1172,1178,1183,1188,1194],{"path":957,"title":958,"description":959,"published":960,"category":961,"image":962,"draft":912},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","Backups","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":964,"title":965,"description":966,"published":967,"category":908,"image":968,"draft":912},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":970,"title":971,"description":972,"published":973,"category":908,"image":974,"draft":912},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":976,"title":977,"description":978,"published":979,"category":908,"image":980,"draft":912},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":982,"title":983,"description":984,"published":985,"category":908,"image":986,"draft":912},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":988,"title":989,"description":990,"published":991,"category":908,"image":992,"draft":912},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":994,"title":995,"description":996,"published":997,"category":908,"image":998,"draft":912},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1000,"title":1001,"description":1002,"published":1003,"category":908,"image":1004,"draft":912},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1006,"title":1007,"description":1008,"published":1009,"category":908,"image":1010,"draft":912},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1012,"title":1013,"description":1014,"published":1015,"category":961,"image":1016,"draft":912},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1018,"title":1019,"description":1020,"published":1021,"category":961,"image":1022,"draft":912},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1024,"title":1025,"description":1026,"published":1027,"category":961,"image":1028,"draft":912},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1030,"title":1031,"description":1032,"published":1033,"category":908,"image":1034,"draft":912},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":1036,"title":1037,"description":1038,"published":1039,"category":908,"image":1040,"draft":912},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1042,"title":1043,"description":1044,"published":1045,"category":908,"image":1046,"draft":912},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1048,"title":1049,"description":1050,"published":1051,"category":908,"image":1052,"draft":912},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":946,"title":5,"description":911,"published":947,"category":908,"image":933,"draft":912},{"path":1055,"title":1056,"description":1057,"published":1058,"category":908,"image":1059,"draft":912},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":60,"title":1061,"description":1062,"published":1063,"category":908,"image":1064,"draft":912},"Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1066,"title":1067,"description":1068,"published":1069,"category":908,"image":1070,"draft":912},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1072,"title":1073,"description":1074,"published":1075,"category":908,"image":1076,"draft":912},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1078,"title":1079,"description":1080,"published":1081,"category":908,"image":1082,"draft":912},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1084,"title":1085,"description":1086,"published":1087,"category":961,"image":1088,"draft":912},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1090,"title":1091,"description":1092,"published":1093,"category":908,"image":1094,"draft":912},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1096,"title":1097,"description":1098,"published":1099,"category":961,"image":1100,"draft":912},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1102,"title":1103,"description":1104,"published":1105,"category":908,"image":1106,"draft":912},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1108,"title":1109,"description":1110,"published":1111,"category":908,"image":1112,"draft":912},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":1114,"title":1115,"description":1116,"published":1117,"category":908,"image":1118,"draft":912},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1120,"title":1121,"description":1122,"published":1123,"category":908,"image":1124,"draft":912},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1126,"title":1127,"description":1128,"published":1129,"category":961,"image":1130,"draft":912},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1132,"title":1133,"description":1134,"published":1135,"category":961,"image":1136,"draft":912},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1138,"title":1139,"description":1140,"published":1141,"category":908,"image":1142,"draft":912},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1144,"title":1145,"description":1146,"published":1147,"category":908,"image":1148,"draft":912},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1150,"title":1151,"description":1152,"published":1153,"category":961,"image":1154,"draft":912},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1156,"title":1157,"description":1158,"published":1159,"category":908,"image":1160,"draft":912},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1162,"title":1163,"description":1164,"published":1159,"category":908,"image":1165,"draft":912},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1167,"title":1168,"description":1169,"published":1170,"category":908,"image":1171,"draft":912},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase's new API keys: which one is safe in your app?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1173,"title":1174,"description":1175,"published":1176,"category":961,"image":1177,"draft":912},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":74,"title":1179,"description":1180,"published":1181,"category":908,"image":1182,"draft":912},"Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1184,"title":1185,"description":1186,"published":1181,"category":961,"image":1187,"draft":912},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1189,"title":1190,"description":1191,"published":1192,"category":961,"image":1193,"draft":912},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":441,"title":1195,"description":1196,"published":1192,"category":908,"image":1197,"draft":912},"Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1790150951364]