[{"data":1,"prerenderedAt":1227},["ShallowReactive",2],{"blog-en-violates-foreign-key-constraint":3,"blog-index-en":699},{"id":4,"title":5,"body":6,"category":658,"cover":659,"coverAlt":660,"description":661,"draft":662,"extension":663,"faq":664,"image":680,"keywords":681,"meta":688,"navigation":689,"ogTitle":5,"path":690,"published":691,"seo":692,"stem":693,"tldr":694,"updated":691,"__hash__":698},"blog_en\u002Fblog\u002Fviolates-foreign-key-constraint.md","\"violates foreign key constraint\" on insert in Supabase",{"type":7,"value":8,"toc":645},"minimark",[9,13,24,31,34,39,50,53,170,179,191,195,198,221,234,247,250,258,265,271,274,278,281,287,295,312,318,341,351,387,391,394,401,407,421,425,439,445,450,454,457,464,470,480,483,489,497,503,507,512,529,532,538,541,545,548,557,579,588,602,606,638],[10,11,12],"p",{},"You press Save on a new profile in your app and nothing changes. The page shows\nno message. The browser console has one:",[14,15,20],"pre",{"className":16,"code":18,"language":19},[17],"language-text","{\n  \"code\": \"23503\",\n  \"details\": \"Key is not present in table \\\"users\\\".\",\n  \"hint\": null,\n  \"message\": \"insert or update on table \\\"profiles\\\" violates foreign key constraint \\\"profiles_id_fkey\\\"\"\n}\n","text",[21,22,18],"code",{"__ignoreMap":23},"",[10,25,26,27,30],{},"Supabase \"violates foreign key constraint\" means the row you tried to save names\na row in another table, and that row does not exist. Here the profile carried an\n",[21,28,29],{},"id"," that should belong to somebody who signed up, and Postgres found nobody with\nthat id. Nothing was saved.",[10,32,33],{},"The quickest way to make the message stop is to delete the rule. The saves go\nthrough after that, and the rows they make point at nothing: an order line with\nno order, a profile with no person behind it. Find out which row is missing and\nwhy first. It has gone missing in one of a few ways.",[35,36,38],"h2",{"id":37},"what-does-violates-foreign-key-constraint-mean-in-supabase","What does \"violates foreign key constraint\" mean in Supabase?",[10,40,41,42,49],{},"It means one column of your row has to match a row in another table, the value\nyou sent matches none of them, and Postgres refused the whole row. Postgres's\n",[43,44,48],"a",{"href":45,"rel":46},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fddl-constraints.html",[47],"nofollow","documentation on constraints","\ndefines the rule in one sentence: a foreign key \"specifies that the values in a\ncolumn (or a group of columns) must match the values appearing in some row of\nanother table.\"",[10,51,52],{},"Think of the other table as a street, and each of its rows as a house with a\nnumber. Your new row is a letter, and the column with the foreign key is the\nhouse number written on it. Postgres is the sorting office. Before it accepts\nthe letter it looks the number up on the street, and a letter for a house that\nis not there comes straight back. The message says which letter came back. The\ndetail line says which street was searched.",[54,55,56,72],"table",{},[57,58,59],"thead",{},[60,61,62,66,69],"tr",{},[63,64,65],"th",{},"Field",[63,67,68],{},"Example",[63,70,71],{},"What it tells you",[73,74,75,99,114,130,145],"tbody",{},[60,76,77,82,87],{},[78,79,80],"td",{},[21,81,21],{},[78,83,84],{},[21,85,86],{},"23503",[78,88,89,90,93,94],{},"Postgres's code for this error, named ",[21,91,92],{},"foreign_key_violation"," in ",[43,95,98],{"href":96,"rel":97},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Futils\u002Ferrcodes.txt",[47],"its list of codes",[60,100,101,106,111],{},[78,102,103],{},[21,104,105],{},"message",[78,107,108],{},[21,109,110],{},"insert or update on table \"profiles\" violates foreign key constraint \"profiles_id_fkey\"",[78,112,113],{},"The table you wrote to, then the name of the rule",[60,115,116,121,127],{},[78,117,118],{},[21,119,120],{},"details",[78,122,123,126],{},[21,124,125],{},"Key (id)=(…) is not present in table \"users\".",", or the same without the value",[78,128,129],{},"The column, the value you sent, and the table Postgres looked in. The next section covers when the value is left out",[60,131,132,137,142],{},[78,133,134],{},[21,135,136],{},"hint",[78,138,139],{},[21,140,141],{},"null",[78,143,144],{},"Nothing to add for this error",[60,146,147,150,155],{},[78,148,149],{},"HTTP status",[78,151,152],{},[21,153,154],{},"409 Conflict",[78,156,157,158,161,162,164,165],{},"PostgREST, the part of Supabase that turns ",[21,159,160],{},"supabase.from(...)"," calls into SQL, maps ",[21,163,86],{}," to 409 in ",[43,166,169],{"href":167,"rel":168},"https:\u002F\u002Fgithub.com\u002FPostgREST\u002Fpostgrest\u002Fblob\u002Fmain\u002Fsrc\u002Flibrary\u002FPostgREST\u002FError.hs",[47],"its code",[10,171,172,173,178],{},"The wording comes from\n",[43,174,177],{"href":175,"rel":176},"https:\u002F\u002Fgithub.com\u002Fpostgres\u002Fpostgres\u002Fblob\u002Fmaster\u002Fsrc\u002Fbackend\u002Futils\u002Fadt\u002Fri_triggers.c",[47],"the file in Postgres that runs these checks",".\nAn update raises it too, when it changes the column to a number with no house,\nwhich is why the message starts \"insert or update\".",[10,180,181,182,185,186,190],{},"A message that starts ",[21,183,184],{},"update or delete on table"," is the same rule seen from the\nstreet's side: you tried to knock down a house that letters still point at. That\none comes from deleting, and\n",[43,187,189],{"href":188},"\u002Fblog\u002Fdatabase-error-deleting-user","the post on deleting users"," covers it.",[35,192,194],{"id":193},"which-row-is-it-looking-for","Which row is it looking for?",[10,196,197],{},"The one in the detail line, in the table that line names. Two things make the\nline harder to read than it looks.",[10,199,200,204,205,208,209,212,213,216,217,220],{},[201,202,203],"strong",{},"The value is sometimes left out."," Postgres prints ",[21,206,207],{},"Key (id)=(…)"," only when the\ncaller is allowed to read that column of your table. When Row Level Security is\non for the table you wrote to,\n",[43,210,169],{"href":175,"rel":211},[47],"\nskips the value, with the comment \"we don't return any specifics to avoid\nleaking data\", and you get ",[21,214,215],{},"Key is not present in table \"users\"."," That is what\na browser request to a protected table sees. The value is the one your app sent,\nso open your browser's developer tools, find the request to ",[21,218,219],{},"\u002Frest\u002Fv1\u002Fprofiles","\nin the Network tab, and read it from the payload.",[10,222,223,224,228,229,233],{},"If your console shows the value for a request your app made with the public key,\nRow Level Security is off on the table you wrote to. A table with its rules off\nhands its rows to a stranger as readily as to you, and\n",[43,225,227],{"href":226},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","turning them on for every table"," covers\nthe switch and the first rule. Our ",[43,230,232],{"href":231},"\u002Fsecurity-scanner","free scan"," reads your live\napp with the public key any visitor gets and lists the tables that answer it. It\nneeds no account.",[10,235,236,204,239,242,243,246],{},[201,237,238],{},"The table name has no schema.",[21,240,241],{},"users",", and in a Supabase\nproject a column pointing at people nearly always points at ",[21,244,245],{},"auth.users",", the\ntable where Supabase Auth keeps everybody who has signed up. It is not among\nyour public tables in the Table Editor, which is why the message reads as if it\nnames a table you never made.",[10,248,249],{},"To see exactly where the rule points, run this in the SQL Editor with the rule's\nname from the message:",[14,251,256],{"className":252,"code":254,"language":255,"meta":23},[253],"language-sql","select conrelid::regclass as on_table,\n       pg_get_constraintdef(oid) as rule\nfrom pg_constraint\nwhere conname = 'profiles_id_fkey';\n","sql",[21,257,254],{"__ignoreMap":23},[10,259,260,261,264],{},"It answers with the table the rule sits on and what the rule says, for example\n",[21,262,263],{},"FOREIGN KEY (id) REFERENCES auth.users(id) ON DELETE CASCADE",": your column, then\nthe table and column it has to match. Then look the value up:",[14,266,269],{"className":267,"code":268,"language":255,"meta":23},[253],"select id, email, created_at from auth.users where id = '…';\n",[21,270,268],{"__ignoreMap":23},[10,272,273],{},"No row back means the person your profile names does not exist in this project.",[35,275,277],{"id":276},"where-does-a-row-that-points-at-nothing-come-from","Where does a row that points at nothing come from?",[10,279,280],{},"From one of a few places, and the table in the detail line tells you where to\nlook first.",[10,282,283,286],{},[201,284,285],{},"The row it points at was never saved, or was saved second."," An order and its\nlines are two saves. If your app saves the lines first, or saves the order, gets\nan error it never reads and carries on with the lines, every line names an order\nthat is not there. Save the row being pointed at first, take its id from the\nanswer, and read the error of each step before the next:",[14,288,293],{"className":289,"code":291,"language":292,"meta":23},[290],"language-js","const { data: order, error } = await supabase\n  .from('orders')\n  .insert({ user_id: user.id })\n  .select('id')\n  .single()\n\nif (error) throw error\n\nconst { error: linesError } = await supabase\n  .from('order_items')\n  .insert(cart.map((item) => ({ ...item, order_id: order.id })))\n","js",[21,294,291],{"__ignoreMap":23},[10,296,297,300,301,306,307,311],{},[21,298,299],{},".select()"," after an insert reads the new row back, so the person needs a rule\nthat lets them read their own orders. Postgres's\n",[43,302,305],{"href":303,"rel":304},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fsql-createpolicy.html",[47],"documentation on policies","\nsays a new row that fails the read rules makes the save throw an error, and in\nSupabase that error is\n",[43,308,310],{"href":309},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","new row violates row-level security policy",".\nThe two saves are separate requests, so if the lines fail, the order is already\nsaved: try the lines again, or delete the order.",[313,314],"diagram",{"alt":315,"caption":316,"src":317},"Two lanes. In the first, an order line addressed to order 14 is sent before that order exists: the street of orders has an empty plot outlined in amber where 14 should stand, and the lane ends at 23503 and 409. In the second, order 14 is saved first and stands lit in teal, the line follows carrying its number, the street has the house, and the lane ends in a tick.","Lines saved before their order point at a house that is not there yet. Save the order, take its id from the answer, then save the lines.","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fsave-the-order-first-1600x760.png",[10,319,320,323,324,326,327,329,330,332,333,336,337,340],{},[201,321,322],{},"The id came from somewhere else."," Every Supabase project keeps its own\n",[21,325,245],{},". An id copied from your test project, one an AI builder left in the\ncode from a preview, or rows copied from one project into another all name people\nthe live project has never seen. When you copy data between projects, copy the\nrows being pointed at before the rows that point at them. The people behind a\ncolumn that points at ",[21,328,245],{}," cannot be copied that way: they sign up in the\nnew project and get new ids when they do. A profile whose ",[21,331,29],{}," must be the\nperson's id also breaks when the app fills it with a fresh random one, such as\n",[21,334,335],{},"crypto.randomUUID()",". That number belongs to no house. Use ",[21,338,339],{},"user.id"," from the\nsigned-in session.",[10,342,343,346,347,350],{},[201,344,345],{},"The row was deleted in between."," A product removed from your shop while it\nsat in somebody's basket, or an account deleted in another tab. The save that\nfollows points at a house that stood when the page loaded. The repair is in your\napp: check for ",[21,348,349],{},"error.code === '23503'"," and tell the person what changed, such as\n\"That product is no longer available.\"",[10,352,353,356,357,359,360,363,364,369,370,373,374,377,378,382,383,386],{},[201,354,355],{},"A trigger that runs too early."," A trigger on ",[21,358,245],{}," that copies each new\nperson into ",[21,361,362],{},"profiles"," has to run after the person is saved. Postgres's\n",[43,365,368],{"href":366,"rel":367},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Ftrigger-datachanges.html",[47],"documentation on triggers","\nsays the change that fires a row-level ",[21,371,372],{},"BEFORE"," trigger \"is naturally not visible\nto SQL commands executed in a row-level BEFORE trigger, because it hasn't\nhappened yet\". A profile written from a ",[21,375,376],{},"before insert"," trigger therefore points\nat a person who does not exist yet. Every sign-up fails, and Supabase reports it\nas ",[43,379,381],{"href":380},"\u002Fblog\u002Fdatabase-error-saving-new-user","\"Database error saving new user\"",".\nSupabase's own pattern, which that post prints in full, uses ",[21,384,385],{},"after insert",".",[35,388,390],{"id":389},"why-does-an-empty-value-get-through","Why does an empty value get through?",[10,392,393],{},"Because a foreign key only checks values that are there. Postgres's documentation\non constraints puts it this way: \"Normally, a referencing row need not satisfy\nthe foreign key constraint if any of its referencing columns are null.\" Null is\nPostgres's word for no value at all. A letter with no house number on it is\nnever looked up. It goes into the sack and belongs to no house.",[10,395,396,397,400],{},"So an order line saved with an empty ",[21,398,399],{},"order_id"," is accepted, and it belongs to\nno order. Your app meets it later as a line that turns up in nobody's basket. The\nsame page names the repair: \"declare the referencing column(s) as NOT NULL\".",[14,402,405],{"className":403,"code":404,"language":255,"meta":23},[253],"alter table public.order_items alter column order_id set not null;\n",[21,406,404],{"__ignoreMap":23},[10,408,409,410,414,415,417,418,386],{},"After that an empty value is refused too, with a message that names the column\noutright, ",[43,411,413],{"href":412},"\u002Fblog\u002Fnull-value-violates-not-null-constraint","null value in column violates not-null constraint",".\nThe statement fails while rows with an empty ",[21,416,399],{}," already exist, so list\nthem first with ",[21,419,420],{},"select * from public.order_items where order_id is null",[35,422,424],{"id":423},"could-a-policy-be-hiding-the-row-it-wants","Could a policy be hiding the row it wants?",[10,426,427,428,433,434,438],{},"No. Postgres checks a foreign key against every row of the other table, whatever\nyour Row Level Security rules say.\n",[43,429,432],{"href":430,"rel":431},"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fddl-rowsecurity.html",[47],"Its documentation on row security","\nis direct about it: \"Referential integrity checks, such as unique or primary key\nconstraints and foreign key references, always bypass row security to ensure\nthat data integrity is maintained.\" In\n",[43,435,437],{"href":175,"rel":436},[47],"the code that runs the check",",\nthe lookup switches to the owner of the other table, with a flag that stops even\na forced rule from applying.",[10,440,441,442,444],{},"So the sorting office works from the full street plan. Your app sees the street\nthrough its rules, which may show it only the houses it is allowed to visit, and\nthe check never uses that view. A ",[21,443,86],{}," means the house is not there for\nanybody. If the row exists and your app cannot see it, the save goes through.",[313,446],{"alt":447,"caption":448,"src":449},"The same street of houses drawn twice. On the left, seen from a browser window through a padlocked fence, only house 12 is lit and the others are faint dashed outlines. On the right, a letter addressed to 14, one of the faint houses, goes down to the same street, where every house is drawn solid, and it is ticked.","Your app reads the rows its rules allow. The foreign key check reads every row, so a row pointing at a house your app cannot see is accepted.","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fthe-check-sees-every-house-1600x760.png",[35,451,453],{"id":452},"can-someone-attach-a-row-to-a-record-that-is-not-theirs","Can someone attach a row to a record that is not theirs?",[10,455,456],{},"Yes, unless your insert rule checks who owns that record. The check that the\nhouse exists ignores your rules, so it says yes to a house that belongs to\nsomebody else.",[10,458,459,460,463],{},"Take ",[21,461,462],{},"order_items"," with this insert rule, which looks safe:",[14,465,468],{"className":466,"code":467,"language":255,"meta":23},[253],"create policy \"Add your own order lines\"\non public.order_items for insert\nto authenticated\nwith check (auth.uid() = user_id);\n",[21,469,467],{"__ignoreMap":23},[10,471,472,473,476,477,479],{},"It checks that the line is yours, and never looks at whose order it joins. A\nsigned-in person who sends their own ",[21,474,475],{},"user_id"," with somebody else's ",[21,478,399],{},"\npasses the rule and passes the foreign key, and a line they wrote now sits on a\nstranger's order. The same shape puts a comment under another person's private\npost, or a member into a team nobody invited them to.",[10,481,482],{},"Replace it with a rule that looks at the order:",[14,484,487],{"className":485,"code":486,"language":255,"meta":23},[253],"create policy \"Add lines to your own orders\"\non public.order_items for insert\nto authenticated\nwith check (\n  exists (\n    select 1 from public.orders\n    where orders.id = order_items.order_id\n      and orders.user_id = auth.uid()\n  )\n);\n",[21,488,486],{"__ignoreMap":23},[10,490,491,492,496],{},"Drop the first rule when you add this one. Postgres combines rules of the same\nkind with \"OR\", in the words of\n",[43,493,495],{"href":303,"rel":494},[47],"its policy documentation",",\nso the old one would still let the line through on its own.",[10,498,499,500,502],{},"The check also answers a question for anyone allowed to insert. The sentence\nafter the one quoted above, in the row security documentation, warns about it:\n\"Care must be taken when developing schemas and row level policies to avoid\n'covert channel' leaks of information through such referential integrity\nchecks.\" A save that fails with ",[21,501,86],{}," says a house is not there. One that\nsucceeds says it is, on a street the person cannot read. Supabase's user ids are\nlong random values that nobody guesses. When a column points at something\nguessable, such as an email address or an id that counts up from 1, a person can\ntry values one at a time and learn which exist.",[35,504,506],{"id":505},"should-you-remove-the-foreign-key","Should you remove the foreign key?",[10,508,509,510,386],{},"No. Without it the save goes through, the row points at nothing, and from then\non nothing tells you when that happens. A basket shows a line for a product you\nremoved last month, and a profile stays behind for a person who is no longer in\n",[21,511,245],{},[10,513,514,515,518,519,521,522,524,525,528],{},"The rule also decides what happens to those rows when the one they point at is\ndeleted. With ",[21,516,517],{},"on delete cascade"," on the rule from ",[21,520,362],{}," to ",[21,523,245],{},",\ndeleting a person deletes their profile. Without the rule, the profile stays,\nwith whatever personal details it holds.\n",[43,526,527],{"href":188},"The post on deleting users"," covers choosing\nwhat each table keeps.",[10,530,531],{},"If old rows already point at nothing, list them before you add a rule back or\ntighten one, because Postgres refuses to add a foreign key while any row breaks\nit:",[14,533,536],{"className":534,"code":535,"language":255,"meta":23},[253],"select i.*\nfrom public.order_items i\nleft join public.orders o on o.id = i.order_id\nwhere i.order_id is not null\n  and o.id is null;\n",[21,537,535],{"__ignoreMap":23},[10,539,540],{},"Decide for each one whether it gets its order back or goes. Deleting them cannot\nbe taken back without a copy of the database from before.",[35,542,544],{"id":543},"before-you-repair-the-rows","Before you repair the rows",[10,546,547],{},"Keep a copy of the database from before you delete rows that point at nothing,\ncopy data between projects or change a rule, and hear about it when a table\nstarts answering strangers.",[10,549,550],{},[201,551,552,556],{},[43,553,555],{"href":554},"\u002Fsupabase-backups","Reeve Care"," keeps a copy of your Supabase database:",[558,559,560,564,567,570,573,576],"ul",{},[561,562,563],"li",{},"an encrypted copy on a schedule, on Reeve's own storage in the EU, outside your Supabase account",[561,565,566],{},"every row as it was before a cleanup deleted the wrong ones",[561,568,569],{},"each copy verified before it counts, by counting the rows in every table",[561,571,572],{},"your uploaded files as well, once you connect a Storage credential",[561,574,575],{},"a one-click restore, with a safety copy of the current state taken first",[561,577,578],{},"everything Monitor does",[10,580,581],{},[201,582,583,587],{},[43,584,586],{"href":585},"\u002Fwebsite-monitoring","Reeve Monitor"," keeps checking from outside:",[558,589,590,593,596,599],{},[561,591,592],{},"whether your app is up, checked every minute",[561,594,595],{},"the full security check every hour, on up to three apps",[561,597,598],{},"an email the day a re-scan grades your app lower than the one before, so a table whose rules were switched off reaches you without you going to look",[561,600,601],{},"a monthly report, in plain language, of what it saw",[35,603,605],{"id":604},"what-to-do-now","What to do now",[607,608,609],"key-takeaways",{},[558,610,611,619,622,625,632,635],{},[561,612,613,614,616,617,386],{},"Read the table in the detail line. In Supabase, ",[21,615,241],{}," there nearly always means ",[21,618,245],{},[561,620,621],{},"Find the value: in the detail line, or in the request your app sent.",[561,623,624],{},"Save the row being pointed at first, take its id from the answer, and read each error before the next save.",[561,626,627,628,631],{},"Give a column that must point somewhere ",[21,629,630],{},"not null",", so an empty value is refused too.",[561,633,634],{},"Make every insert rule check who owns the row the new one points at.",[561,636,637],{},"Keep the foreign key, and list the rows that point at nothing before you delete any.",[10,639,640,641,644],{},"Start with the table in the detail line and the id your app sent. If the repair\ndeletes rows or copies them between projects,\n",[43,642,643],{"href":554},"keep a copy of the database"," from before you run it.",{"title":23,"searchDepth":646,"depth":646,"links":647},3,[648,650,651,652,653,654,655,656,657],{"id":37,"depth":649,"text":38},2,{"id":193,"depth":649,"text":194},{"id":276,"depth":649,"text":277},{"id":389,"depth":649,"text":390},{"id":423,"depth":649,"text":424},{"id":452,"depth":649,"text":453},{"id":505,"depth":649,"text":506},{"id":543,"depth":649,"text":544},{"id":604,"depth":649,"text":605},"Security basics","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcover-1200x630.png","A street of numbered houses with one plot standing empty, outlined in amber, and a letter in front addressed to the missing number.","Supabase \"insert or update on table violates foreign key constraint\": your row points at a row that is not there. Which one, why, and the fix.",false,"md",[665,668,671,674,677],{"q":666,"a":667},"What does insert or update on table violates foreign key constraint mean?","The row you tried to save points at a row in another table that does not exist, and Postgres refused it. Nothing was written. The message names the table you wrote to and the rule, and the detail line names the table Postgres looked in. The code is 23503, and from a Supabase app it arrives as HTTP 409.",{"q":669,"a":670},"Why does the error say table \"users\" when I have no users table?","Because the table it means is almost certainly auth.users, where Supabase Auth keeps everyone who has signed up. Postgres prints a table's name without its schema. Your column points at a person, and the id it holds belongs to nobody in this project.",{"q":672,"a":673},"Can Row Level Security cause a foreign key error?","No. Postgres checks a foreign key against every row of the other table, including rows your rules hide, so the error means the row really is not there. The same fact works the other way: a row pointing at a record the person cannot see is accepted, unless your insert rule checks who owns that record.",{"q":675,"a":676},"Why does the detail line say \"Key is not present\" without the value?","Postgres leaves the value out when Row Level Security is on for the table you wrote to, or when the caller may not read that column. The value is the one your app sent, so read it from the request in the Network tab of your browser's developer tools.",{"q":678,"a":679},"Should I drop the foreign key to make the error stop?","No. The saves go through and the rows point at nothing: an order line with no order, a profile with nobody behind it. The rule also decides what happens to those rows when a user is deleted. Find which row is missing and save it first, or correct the id.","\u002Fblog\u002Fviolates-foreign-key-constraint\u002Fcard-800x500.png",[682,683,684,685,686,687],"violates foreign key constraint supabase","insert or update on table violates foreign key constraint","key is not present in table","postgres 23503","supabase foreign key auth.users","supabase foreign key row level security",{},true,"\u002Fblog\u002Fviolates-foreign-key-constraint","2026-11-07",{"title":5,"description":661},"blog\u002Fviolates-foreign-key-constraint",[695,696,697],"Supabase \"violates foreign key constraint\" on an insert (Postgres code 23503, HTTP 409 in your app) means the row you saved names a row in another table that does not exist. Nothing was saved. The message names your table and the rule, and the detail line names the table Postgres looked in.","The missing row was never saved, was saved second, was deleted in the meantime, or lives in another project. When the detail line says \"users\", it nearly always means auth.users, where Supabase Auth keeps everyone who has signed up.","The check reads every row of the other table, whatever your Row Level Security rules say. So it also accepts a row that points at somebody else's record, and your insert rule has to check who owns that record.","bAbZsOHlwmCNCpIk5dMjflVN1tsRrepu0SbPM7V69Gs",[700,706,712,713,718,724,730,736,742,748,754,760,766,772,778,784,790,796,802,808,814,820,826,832,838,844,850,855,861,867,873,879,885,891,897,903,909,915,921,927,933,939,945,951,957,963,968,974,980,986,992,998,1004,1010,1016,1022,1028,1034,1040,1046,1052,1058,1063,1069,1075,1081,1087,1093,1099,1105,1111,1117,1123,1129,1135,1141,1146,1152,1158,1164,1170,1176,1182,1188,1193,1199,1205,1211,1216,1222],{"path":701,"title":702,"description":703,"published":704,"category":658,"image":705,"draft":662},"\u002Fblog\u002Fmax-client-connections-reached","Supabase \"max client connections reached\", explained","Supabase \"max client connections reached\" means the pooler has no room for one more client. The port in your connection string decides the limit.","2026-11-09","\u002Fblog\u002Fmax-client-connections-reached\u002Fcard-800x500.png",{"path":707,"title":708,"description":709,"published":710,"category":658,"image":711,"draft":662},"\u002Fblog\u002Funsupported-provider-provider-is-not-enabled","\"Unsupported provider: provider is not enabled\" in Supabase","\"Unsupported provider: provider is not enabled\" means Google sign-in is off in your Supabase project. How to turn it on, and fix redirect_uri_mismatch.","2026-11-08","\u002Fblog\u002Funsupported-provider-provider-is-not-enabled\u002Fcard-800x500.png",{"path":690,"title":5,"description":661,"published":691,"category":658,"image":680,"draft":662},{"path":412,"title":714,"description":715,"published":716,"category":658,"image":717,"draft":662},"\"null value in column violates not-null constraint\" in Supabase","Supabase \"null value in column violates not-null constraint\": a required column arrived empty. Where the null came from, and the fix.","2026-11-06","\u002Fblog\u002Fnull-value-violates-not-null-constraint\u002Fcard-800x500.png",{"path":719,"title":720,"description":721,"published":722,"category":658,"image":723,"draft":662},"\u002Fblog\u002Fauth-session-missing","Supabase \"Auth session missing!\": where the session went","\"Auth session missing!\" is supabase-js finding no signed-in session and stopping before it asks Supabase. Where the session went, and the fix for each.","2026-11-05","\u002Fblog\u002Fauth-session-missing\u002Fcard-800x500.png",{"path":725,"title":726,"description":727,"published":728,"category":658,"image":729,"draft":662},"\u002Fblog\u002Finvalid-claim-missing-sub-claim","Supabase \"invalid claim: missing sub claim\": nobody is signed in","\"invalid claim: missing sub claim\" means Supabase Auth got a genuine token that names no user: your project key, sent where a session belongs.","2026-11-04","\u002Fblog\u002Finvalid-claim-missing-sub-claim\u002Fcard-800x500.png",{"path":731,"title":732,"description":733,"published":734,"category":658,"image":735,"draft":662},"\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function","\"Failed to send a request to the Edge Function\" in Supabase","\"Failed to send a request to the Edge Function\" means the browser got no reply it could read. Its console says why, and whether your function ran.","2026-11-03","\u002Fblog\u002Ffailed-to-send-a-request-to-the-edge-function\u002Fcard-800x500.png",{"path":737,"title":738,"description":739,"published":740,"category":658,"image":741,"draft":662},"\u002Fblog\u002Fsupabase-auth-redirects-to-localhost","Why Supabase email links redirect to localhost:3000","A Supabase redirect to localhost:3000 means the Site URL was never changed, or your address is missing from Redirect URLs. The fix, and the wildcard to avoid.","2026-11-02","\u002Fblog\u002Fsupabase-auth-redirects-to-localhost\u002Fcard-800x500.png",{"path":743,"title":744,"description":745,"published":746,"category":658,"image":747,"draft":662},"\u002Fblog\u002Femail-link-is-invalid-or-has-expired","Supabase \"Email link is invalid or has expired\" on a fresh link","On a link sent a minute ago, Supabase's \"Email link is invalid or has expired\" usually means a mail filter used it first. How to check and fix it.","2026-11-01","\u002Fblog\u002Femail-link-is-invalid-or-has-expired\u002Fcard-800x500.png",{"path":749,"title":750,"description":751,"published":752,"category":658,"image":753,"draft":662},"\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout","Supabase \"canceling statement due to statement timeout\", explained","Supabase \"canceling statement due to statement timeout\" means a query outran its role's limit, 3 seconds for a visitor. Check the RLS policy first.","2026-10-31","\u002Fblog\u002Fcanceling-statement-due-to-statement-timeout\u002Fcard-800x500.png",{"path":188,"title":755,"description":756,"published":757,"category":758,"image":759,"draft":662},"\"Database error deleting user\" in Supabase, and what goes with it","\"Database error deleting user\" in Supabase means your database refused the delete. The reason is in your logs, and the fix decides what else is deleted.","2026-10-30","Backups","\u002Fblog\u002Fdatabase-error-deleting-user\u002Fcard-800x500.png",{"path":761,"title":762,"description":763,"published":764,"category":658,"image":765,"draft":662},"\u002Fblog\u002Fstripe-webhook-no-signatures-found","\"No signatures found matching the expected signature\" in Supabase","A Stripe webhook in a Supabase Edge Function that says \"No signatures found matching the expected signature\" has one of two causes. Never stop checking.","2026-10-29","\u002Fblog\u002Fstripe-webhook-no-signatures-found\u002Fcard-800x500.png",{"path":767,"title":768,"description":769,"published":770,"category":658,"image":771,"draft":662},"\u002Fblog\u002Fsupabase-invalid-login","\"Invalid login credentials\" in Supabase: the three causes","Supabase says \"Invalid login credentials\" for a wrong password, an unknown email and a Google account. How to tell which, and why it is vague.","2026-10-28","\u002Fblog\u002Fsupabase-invalid-login\u002Fcard-800x500.png",{"path":773,"title":774,"description":775,"published":776,"category":658,"image":777,"draft":662},"\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code","\"Edge Function returned a non-2xx status code\" in Supabase","\"Edge Function returned a non-2xx status code\" means your Supabase function answered with an error. Here is where to read the real one.","2026-10-27","\u002Fblog\u002Fedge-function-returned-a-non-2xx-status-code\u002Fcard-800x500.png",{"path":779,"title":780,"description":781,"published":782,"category":658,"image":783,"draft":662},"\u002Fblog\u002Fcertificate-not-trusted","Certificate not trusted: the three causes besides expiry","Certificate not trusted, and the date is fine? It names another address, it signed itself, or its chain is missing a link. How to tell which.","2026-10-26","\u002Fblog\u002Fcertificate-not-trusted\u002Fcard-800x500.png",{"path":785,"title":786,"description":787,"published":788,"category":658,"image":789,"draft":662},"\u002Fblog\u002Finvalid-input-syntax-for-type-uuid","Supabase \"invalid input syntax for type uuid\": read the quotes","Supabase \"invalid input syntax for type uuid\" means your app sent something that is not an id. Read the quotes, hold the query, keep the column.","2026-10-25","\u002Fblog\u002Finvalid-input-syntax-for-type-uuid\u002Fcard-800x500.png",{"path":791,"title":792,"description":793,"published":794,"category":658,"image":795,"draft":662},"\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint","Supabase \"duplicate key value violates unique constraint\", explained","Supabase \"duplicate key value violates unique constraint\" means the value is already taken. Find the column, pick a fix, and keep the value off screen.","2026-10-24","\u002Fblog\u002Fduplicate-key-value-violates-unique-constraint\u002Fcard-800x500.png",{"path":797,"title":798,"description":799,"published":800,"category":658,"image":801,"draft":662},"\u002Fblog\u002Fsupabase-relation-does-not-exist","Supabase \"relation does not exist\" when the table is right there","Supabase \"relation does not exist\" or PGRST205 means no table matches the name and schema your query used. Four checks, and what exposing a schema opens.","2026-10-23","\u002Fblog\u002Fsupabase-relation-does-not-exist\u002Fcard-800x500.png",{"path":803,"title":804,"description":805,"published":806,"category":658,"image":807,"draft":662},"\u002Fblog\u002Fsupabase-function-not-found","Supabase PGRST202: \"Could not find the function in the schema cache\"","Supabase \"Could not find the function in the schema cache\" lists the argument names your app sent. Compare them with the function first.","2026-10-22","\u002Fblog\u002Fsupabase-function-not-found\u002Fcard-800x500.png",{"path":809,"title":810,"description":811,"published":812,"category":658,"image":813,"draft":662},"\u002Fblog\u002Fsupabase-schema-cache-column-error","Supabase PGRST204: \"Could not find the column in the schema cache\"","Supabase \"Could not find the column in the schema cache\" usually means a name mismatch. Four checks in order, and the one-line reload.","2026-10-21","\u002Fblog\u002Fsupabase-schema-cache-column-error\u002Fcard-800x500.png",{"path":815,"title":816,"description":817,"published":818,"category":658,"image":819,"draft":662},"\u002Fblog\u002Fsupabase-email-rate-limit-exceeded","Supabase \"Email Rate Limit Exceeded\": two limits, one error code","Supabase \"Email Rate Limit Exceeded\" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it.","2026-10-20","\u002Fblog\u002Fsupabase-email-rate-limit-exceeded\u002Fcard-800x500.png",{"path":821,"title":822,"description":823,"published":824,"category":658,"image":825,"draft":662},"\u002Fblog\u002Fsupabase-users-logged-out","Supabase \"Invalid Refresh Token: Refresh Token Not Found\": 3 causes","Supabase \"Invalid Refresh Token: Refresh Token Not Found\" logs your users out. Three causes, and how the auth log tells them apart.","2026-10-19","\u002Fblog\u002Fsupabase-users-logged-out\u002Fcard-800x500.png",{"path":827,"title":828,"description":829,"published":830,"category":658,"image":831,"draft":662},"\u002Fblog\u002Fpermission-denied-for-schema-public","Supabase \"permission denied for schema public\": three causes","Supabase \"permission denied for schema public\" means a missing schema grant. What removed it, and the line that puts it back.","2026-10-18","\u002Fblog\u002Fpermission-denied-for-schema-public\u002Fcard-800x500.png",{"path":833,"title":834,"description":835,"published":836,"category":658,"image":837,"draft":662},"\u002Fblog\u002Fsupabase-bucket-not-found","Supabase \"Bucket not found\": the three things it means","Supabase \"Bucket not found\" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project.","2026-10-17","\u002Fblog\u002Fsupabase-bucket-not-found\u002Fcard-800x500.png",{"path":839,"title":840,"description":841,"published":842,"category":658,"image":843,"draft":662},"\u002Fblog\u002Fsupabase-invalid-jwt","Supabase invalid JWT: which key stopped working?","A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key.","2026-10-16","\u002Fblog\u002Fsupabase-invalid-jwt\u002Fcard-800x500.png",{"path":845,"title":846,"description":847,"published":848,"category":658,"image":849,"draft":662},"\u002Fblog\u002Fsupabase-single-row-error","Supabase \"multiple (or no) rows returned\" usually means no rows","Supabase returns PGRST116, \"JSON object requested, multiple (or no) rows returned\", when your query found none. A row your rules hide looks missing.","2026-10-15","\u002Fblog\u002Fsupabase-single-row-error\u002Fcard-800x500.png",{"path":380,"title":851,"description":852,"published":853,"category":658,"image":854,"draft":662},"\"Database error saving new user\" in Supabase, and where to look","\"Database error saving new user\" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs.","2026-10-14","\u002Fblog\u002Fdatabase-error-saving-new-user\u002Fcard-800x500.png",{"path":856,"title":857,"description":858,"published":859,"category":658,"image":860,"draft":662},"\u002Fblog\u002Fwhat-is-supabase","What is Supabase? The database your builder picked for you","What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours.","2026-10-13","\u002Fblog\u002Fwhat-is-supabase\u002Fcard-800x500.png",{"path":862,"title":863,"description":864,"published":865,"category":658,"image":866,"draft":662},"\u002Fblog\u002Faws-access-key-exposed-in-frontend","An AWS access key exposed in your frontend is not like an OpenAI key","An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key.","2026-10-12","\u002Fblog\u002Faws-access-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":868,"title":869,"description":870,"published":871,"category":658,"image":872,"draft":662},"\u002Fblog\u002Fstorage-upload-violates-row-level-security","\"Row-level security policy for table objects\" on upload","\"New row violates row-level security policy for table objects\" means your upload has no insert rule. Making the bucket public does not add one.","2026-10-11","\u002Fblog\u002Fstorage-upload-violates-row-level-security\u002Fcard-800x500.png",{"path":874,"title":875,"description":876,"published":877,"category":658,"image":878,"draft":662},"\u002Fblog\u002Fbase44-security-scan","Base44 security scan: the one thing only it can see","The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at.","2026-10-10","\u002Fblog\u002Fbase44-security-scan\u002Fcard-800x500.png",{"path":880,"title":881,"description":882,"published":883,"category":658,"image":884,"draft":662},"\u002Fblog\u002Fapi-key-leaked-what-to-do","Your API key leaked. Here is the order to do things in","An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed.","2026-10-09","\u002Fblog\u002Fapi-key-leaked-what-to-do\u002Fcard-800x500.png",{"path":886,"title":887,"description":888,"published":889,"category":658,"image":890,"draft":662},"\u002Fblog\u002Finfinite-recursion-in-policy-for-relation","\"Infinite recursion detected in policy\" without disabling RLS","\"Infinite recursion detected in policy for relation\" means your Supabase policy asked the table it protects. Here is how to break the circle.","2026-10-08","\u002Fblog\u002Finfinite-recursion-in-policy-for-relation\u002Fcard-800x500.png",{"path":892,"title":893,"description":894,"published":895,"category":658,"image":896,"draft":662},"\u002Fblog\u002Fno-api-key-found-in-request","\"No API key found in request\" in Supabase, and the wrong fix","\"No API key found in request\" means your Supabase request arrived without a key. Most answers you find point at your database rules instead.","2026-10-07","\u002Fblog\u002Fno-api-key-found-in-request\u002Fcard-800x500.png",{"path":898,"title":899,"description":900,"published":901,"category":658,"image":902,"draft":662},"\u002Fblog\u002Fis-base44-safe","Is Base44 safe? What 5,442 live Base44 apps showed","Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer.","2026-10-06","\u002Fblog\u002Fis-base44-safe\u002Fcard-800x500.png",{"path":904,"title":905,"description":906,"published":907,"category":658,"image":908,"draft":662},"\u002Fblog\u002Fmove-a-secret-to-an-edge-function","Hide an API key: move it to a Supabase Edge Function","Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more.","2026-10-05","\u002Fblog\u002Fmove-a-secret-to-an-edge-function\u002Fcard-800x500.png",{"path":910,"title":911,"description":912,"published":913,"category":658,"image":914,"draft":662},"\u002Fblog\u002Fenv-file-exposed-on-your-server","Is your .env file exposed? The twelve paths to check","Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public.","2026-10-04","\u002Fblog\u002Fenv-file-exposed-on-your-server\u002Fcard-800x500.png",{"path":916,"title":917,"description":918,"published":919,"category":658,"image":920,"draft":662},"\u002Fblog\u002Fis-v0-safe","v0 security: all 1,790 v0 apps we scanned got an A","v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring.","2026-10-03","\u002Fblog\u002Fis-v0-safe\u002Fcard-800x500.png",{"path":922,"title":923,"description":924,"published":925,"category":658,"image":926,"draft":662},"\u002Fblog\u002Fis-bolt-safe","Is Bolt safe? What 1,123 live Bolt apps showed","Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps.","2026-10-02","\u002Fblog\u002Fis-bolt-safe\u002Fcard-800x500.png",{"path":928,"title":929,"description":930,"published":931,"category":658,"image":932,"draft":662},"\u002Fblog\u002Fis-supabase-down-or-your-app","Is Supabase down, or is it your app? How to tell","Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart.","2026-10-01","\u002Fblog\u002Fis-supabase-down-or-your-app\u002Fcard-800x500.png",{"path":934,"title":935,"description":936,"published":937,"category":658,"image":938,"draft":662},"\u002Fblog\u002Fdoes-supabase-encrypt-my-data","Does Supabase encrypt my data? Yes. Here is what it stops","Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops.","2026-09-30","\u002Fblog\u002Fdoes-supabase-encrypt-my-data\u002Fcard-800x500.png",{"path":940,"title":941,"description":942,"published":943,"category":658,"image":944,"draft":662},"\u002Fblog\u002Fsupabase-free-plan-limits","Supabase free plan limits, and what happens at each one","The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes.","2026-09-29","\u002Fblog\u002Fsupabase-free-plan-limits\u002Fcard-800x500.png",{"path":946,"title":947,"description":948,"published":949,"category":758,"image":950,"draft":662},"\u002Fblog\u002Ftest-your-supabase-backup","Test your Supabase backup before the day you need it","How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing.","2026-09-28","\u002Fblog\u002Ftest-your-supabase-backup\u002Fcard-800x500.png",{"path":952,"title":953,"description":954,"published":955,"category":758,"image":956,"draft":662},"\u002Fblog\u002Fsupabase-backup-github-action","Free Supabase backup with a GitHub Action, and the catch","A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses.","2026-09-27","\u002Fblog\u002Fsupabase-backup-github-action\u002Fcard-800x500.png",{"path":958,"title":959,"description":960,"published":961,"category":758,"image":962,"draft":662},"\u002Fblog\u002Fdownload-your-supabase-backup","Why you can't download your Supabase backup","You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own.","2026-09-26","\u002Fblog\u002Fdownload-your-supabase-backup\u002Fcard-800x500.png",{"path":964,"title":965,"description":966,"published":961,"category":658,"image":967,"draft":662},"\u002Fblog\u002Fsupabase-permission-denied-for-table","Supabase \"permission denied for table\": the missing grant","From October 30, a new Supabase table answers \"permission denied for table\" until you grant access. The grant the email shows is half the fix.","\u002Fblog\u002Fsupabase-permission-denied-for-table\u002Fcard-800x500.png",{"path":969,"title":970,"description":971,"published":972,"category":658,"image":973,"draft":662},"\u002Fblog\u002Fopen-api-endpoint-exposed","Is an open API endpoint a security problem? Look at the JSON","Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own.","2026-09-25","\u002Fblog\u002Fopen-api-endpoint-exposed\u002Fcard-800x500.png",{"path":975,"title":976,"description":977,"published":978,"category":658,"image":979,"draft":662},"\u002Fblog\u002Flovable-security-scan","Lovable security scan: the one thing it cannot prove","Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove.","2026-09-24","\u002Fblog\u002Flovable-security-scan\u002Fcard-800x500.png",{"path":981,"title":982,"description":983,"published":984,"category":758,"image":985,"draft":662},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":987,"title":988,"description":989,"published":990,"category":658,"image":991,"draft":662},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":993,"title":994,"description":995,"published":996,"category":658,"image":997,"draft":662},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":999,"title":1000,"description":1001,"published":1002,"category":658,"image":1003,"draft":662},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":1005,"title":1006,"description":1007,"published":1008,"category":658,"image":1009,"draft":662},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":1011,"title":1012,"description":1013,"published":1014,"category":658,"image":1015,"draft":662},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":1017,"title":1018,"description":1019,"published":1020,"category":658,"image":1021,"draft":662},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":1023,"title":1024,"description":1025,"published":1026,"category":658,"image":1027,"draft":662},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":1029,"title":1030,"description":1031,"published":1032,"category":658,"image":1033,"draft":662},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":1035,"title":1036,"description":1037,"published":1038,"category":758,"image":1039,"draft":662},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":1041,"title":1042,"description":1043,"published":1044,"category":758,"image":1045,"draft":662},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":1047,"title":1048,"description":1049,"published":1050,"category":758,"image":1051,"draft":662},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":1053,"title":1054,"description":1055,"published":1056,"category":658,"image":1057,"draft":662},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":226,"title":1059,"description":1060,"published":1061,"category":658,"image":1062,"draft":662},"Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":1064,"title":1065,"description":1066,"published":1067,"category":658,"image":1068,"draft":662},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":1070,"title":1071,"description":1072,"published":1073,"category":658,"image":1074,"draft":662},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":1076,"title":1077,"description":1078,"published":1079,"category":658,"image":1080,"draft":662},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Eight tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":1082,"title":1083,"description":1084,"published":1085,"category":658,"image":1086,"draft":662},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":1088,"title":1089,"description":1090,"published":1091,"category":658,"image":1092,"draft":662},"\u002Fblog\u002Fvibe-coding-security-scanner","Vibe coding security scanner: what a URL scan misses","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.","2026-09-05","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",{"path":1094,"title":1095,"description":1096,"published":1097,"category":658,"image":1098,"draft":662},"\u002Fblog\u002Fmissing-security-headers","Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":1100,"title":1101,"description":1102,"published":1103,"category":658,"image":1104,"draft":662},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1106,"title":1107,"description":1108,"published":1109,"category":658,"image":1110,"draft":662},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":1112,"title":1113,"description":1114,"published":1115,"category":758,"image":1116,"draft":662},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":1118,"title":1119,"description":1120,"published":1121,"category":658,"image":1122,"draft":662},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":1124,"title":1125,"description":1126,"published":1127,"category":758,"image":1128,"draft":662},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":1130,"title":1131,"description":1132,"published":1133,"category":658,"image":1134,"draft":662},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":1136,"title":1137,"description":1138,"published":1139,"category":658,"image":1140,"draft":662},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":309,"title":1142,"description":1143,"published":1144,"category":658,"image":1145,"draft":662},"New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":1147,"title":1148,"description":1149,"published":1150,"category":658,"image":1151,"draft":662},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":1153,"title":1154,"description":1155,"published":1156,"category":758,"image":1157,"draft":662},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":1159,"title":1160,"description":1161,"published":1162,"category":758,"image":1163,"draft":662},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":1165,"title":1166,"description":1167,"published":1168,"category":658,"image":1169,"draft":662},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":1171,"title":1172,"description":1173,"published":1174,"category":658,"image":1175,"draft":662},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":1177,"title":1178,"description":1179,"published":1180,"category":758,"image":1181,"draft":662},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":1183,"title":1184,"description":1185,"published":1186,"category":658,"image":1187,"draft":662},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":1189,"title":1190,"description":1191,"published":1186,"category":658,"image":1192,"draft":662},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":1194,"title":1195,"description":1196,"published":1197,"category":658,"image":1198,"draft":662},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase publishable key: is it the same as the anon key?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":1200,"title":1201,"description":1202,"published":1203,"category":758,"image":1204,"draft":662},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":1206,"title":1207,"description":1208,"published":1209,"category":658,"image":1210,"draft":662},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":1212,"title":1213,"description":1214,"published":1209,"category":758,"image":1215,"draft":662},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":1217,"title":1218,"description":1219,"published":1220,"category":758,"image":1221,"draft":662},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":1223,"title":1224,"description":1225,"published":1220,"category":658,"image":1226,"draft":662},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1794213635058]