https://reeve.page/blog Plain-language posts on Supabase, backups and the security of apps made with AI builders. en Thu, 22 Oct 2026 00:00:00 GMT https://reeve.page/blog/supabase-function-not-found https://reeve.page/blog/supabase-function-not-found Thu, 22 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase "Could not find the function in the schema cache" lists the argument names your app sent. Compare them with the function first. https://reeve.page/blog/supabase-schema-cache-column-error https://reeve.page/blog/supabase-schema-cache-column-error Wed, 21 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase "Could not find the column in the schema cache" usually means a name mismatch. Four checks in order, and the one-line reload. https://reeve.page/blog/supabase-email-rate-limit-exceeded https://reeve.page/blog/supabase-email-rate-limit-exceeded Tue, 20 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase "Email Rate Limit Exceeded" caps every email your project sends: 2 an hour on the built-in sender. What it counts and how to lift it. https://reeve.page/blog/supabase-users-logged-out https://reeve.page/blog/supabase-users-logged-out Mon, 19 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase "Invalid Refresh Token: Refresh Token Not Found" logs your users out. Three causes, and how the auth log tells them apart. https://reeve.page/blog/permission-denied-for-schema-public https://reeve.page/blog/permission-denied-for-schema-public Sun, 18 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase "permission denied for schema public" means a missing schema grant. What removed it, and the line that puts it back. https://reeve.page/blog/supabase-bucket-not-found https://reeve.page/blog/supabase-bucket-not-found Sat, 17 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase "Bucket not found" is one of three things: a public link to a private bucket, a name that is not an exact match, or the wrong project. https://reeve.page/blog/supabase-invalid-jwt https://reeve.page/blog/supabase-invalid-jwt Fri, 16 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics A Supabase invalid JWT error is PGRST301, and it means a signed token failed verification. On a newer project that token is your user, not your API key. https://reeve.page/blog/supabase-single-row-error https://reeve.page/blog/supabase-single-row-error Thu, 15 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase returns PGRST116, "JSON object requested, multiple (or no) rows returned", when your query found none. A row your rules hide looks missing. https://reeve.page/blog/database-error-saving-new-user https://reeve.page/blog/database-error-saving-new-user Wed, 14 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics "Database error saving new user" means something attached to your Supabase signup failed and it was all rolled back. The real error is in your logs. https://reeve.page/blog/what-is-supabase https://reeve.page/blog/what-is-supabase Tue, 13 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics What is Supabase: the database, login and file storage behind your app. Supabase runs the servers; the rules about who reads your rows are yours. https://reeve.page/blog/aws-access-key-exposed-in-frontend https://reeve.page/blog/aws-access-key-exposed-in-frontend Mon, 12 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics An AWS access key exposed in your frontend reads and writes your storage. The fix is usually a presigned URL rather than a new key. https://reeve.page/blog/storage-upload-violates-row-level-security https://reeve.page/blog/storage-upload-violates-row-level-security Sun, 11 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics "New row violates row-level security policy for table objects" means your upload has no insert rule. Making the bucket public does not add one. https://reeve.page/blog/base44-security-scan https://reeve.page/blog/base44-security-scan Sat, 10 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics The Base44 security scan checks seven kinds of problem from inside your app. Here is the half it reads that nothing outside can, and the half it never looks at. https://reeve.page/blog/api-key-leaked-what-to-do https://reeve.page/blog/api-key-leaked-what-to-do Fri, 09 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics An API key leaked and you want to know what to do first. Not every key in your frontend is one, and the order matters more than the speed. https://reeve.page/blog/infinite-recursion-in-policy-for-relation https://reeve.page/blog/infinite-recursion-in-policy-for-relation Thu, 08 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics "Infinite recursion detected in policy for relation" means your Supabase policy asked the table it protects. Here is how to break the circle. https://reeve.page/blog/no-api-key-found-in-request https://reeve.page/blog/no-api-key-found-in-request Wed, 07 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics "No API key found in request" means your Supabase request arrived without a key. Most answers you find point at your database rules instead. https://reeve.page/blog/is-base44-safe https://reeve.page/blog/is-base44-safe Tue, 06 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Is Base44 safe? We ran nine checks on 5,442 live Base44 apps. Almost all scored B for reasons the owner never chose, and one question nobody can answer. https://reeve.page/blog/move-a-secret-to-an-edge-function https://reeve.page/blog/move-a-secret-to-an-edge-function Mon, 05 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Hiding an API key means moving it off the browser, and a Supabase Edge Function is the smallest place to put it. Two steps around the move matter more. https://reeve.page/blog/env-file-exposed-on-your-server https://reeve.page/blog/env-file-exposed-on-your-server Sun, 04 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Is your .env file exposed on your own web server? Twelve addresses tell you in a minute, and a hit means everything in the file is already public. https://reeve.page/blog/is-v0-safe https://reeve.page/blog/is-v0-safe Sat, 03 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics v0 security, measured on 1,790 live v0 apps: every one graded A. Only 17 named a database, and that is most of what the A is measuring. https://reeve.page/blog/is-bolt-safe https://reeve.page/blog/is-bolt-safe Fri, 02 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Is Bolt safe? We ran nine checks on 1,123 live Bolt apps. The hosting came back clean. The findings were API keys and open tables inside the apps. https://reeve.page/blog/is-supabase-down-or-your-app https://reeve.page/blog/is-supabase-down-or-your-app Thu, 01 Oct 2026 00:00:00 GMT Vlad Tkachenko Security basics Is Supabase down, or is it your app? A paused project, a full database and a bug of your own all look like an outage. Four checks tell them apart. https://reeve.page/blog/does-supabase-encrypt-my-data https://reeve.page/blog/does-supabase-encrypt-my-data Wed, 30 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Does Supabase encrypt data? Yes: AES-256 at rest, TLS in transit, SOC 2 and ISO 27001 audited. What each one covers, and the leak none of them stops. https://reeve.page/blog/supabase-free-plan-limits https://reeve.page/blog/supabase-free-plan-limits Tue, 29 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics The Supabase free plan limits you to 500 MB of database and 5 GB of egress, with no backups. What happens as you cross each line, and what $25 changes. https://reeve.page/blog/test-your-supabase-backup https://reeve.page/blog/test-your-supabase-backup Mon, 28 Sep 2026 00:00:00 GMT Vlad Tkachenko Backups How to test your Supabase backup: restore it into a spare project, compare the row counts, sign in, and check for the line a cut-off file is missing. https://reeve.page/blog/supabase-backup-github-action https://reeve.page/blog/supabase-backup-github-action Sun, 27 Sep 2026 00:00:00 GMT Vlad Tkachenko Backups A Supabase backup GitHub Action costs nothing and suits a lot of apps. The workflow, the connection string that works on GitHub, and the egress each run uses. https://reeve.page/blog/download-your-supabase-backup https://reeve.page/blog/download-your-supabase-backup Sat, 26 Sep 2026 00:00:00 GMT Vlad Tkachenko Backups You can't download your Supabase backup on a current project, because the daily copy is a physical snapshot. How to tell, and how to hold a copy of your own. https://reeve.page/blog/supabase-permission-denied-for-table https://reeve.page/blog/supabase-permission-denied-for-table Sat, 26 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics From October 30, a new Supabase table answers "permission denied for table" until you grant access. The grant the email shows is half the fix. https://reeve.page/blog/open-api-endpoint-exposed https://reeve.page/blog/open-api-endpoint-exposed Fri, 25 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Your scan flagged an open API endpoint. Whether it matters depends on what came back, and most of the ones we found were the platform's own. https://reeve.page/blog/lovable-security-scan https://reeve.page/blog/lovable-security-scan Thu, 24 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Lovable security scan: what the Quick and Deep scans check, when each one runs, and the one thing no scan from inside your project can prove. https://reeve.page/blog/supabase-backup-auth-users https://reeve.page/blog/supabase-backup-auth-users Wed, 23 Sep 2026 00:00:00 GMT Vlad Tkachenko Backups Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely. https://reeve.page/blog/domain-and-certificate-expiry https://reeve.page/blog/domain-and-certificate-expiry Tue, 22 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both. https://reeve.page/blog/is-lovable-safe https://reeve.page/blog/is-lovable-safe Mon, 21 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself. https://reeve.page/blog/vibe-coded-app-security-checklist https://reeve.page/blog/vibe-coded-app-security-checklist Sun, 20 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test. https://reeve.page/blog/stripe-secret-key-in-frontend https://reeve.page/blog/stripe-secret-key-in-frontend Sat, 19 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there. https://reeve.page/blog/vite-and-next-public-env-vars https://reeve.page/blog/vite-and-next-public-env-vars Fri, 18 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost. https://reeve.page/blog/base44-source-maps https://reeve.page/blog/base44-source-maps Thu, 17 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short. https://reeve.page/blog/is-cursor-ai-safe https://reeve.page/blog/is-cursor-ai-safe Wed, 16 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open. https://reeve.page/blog/is-replit-safe https://reeve.page/blog/is-replit-safe Tue, 15 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was. https://reeve.page/blog/supabase-storage-backup https://reeve.page/blog/supabase-storage-backup Mon, 14 Sep 2026 00:00:00 GMT Vlad Tkachenko Backups A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken. https://reeve.page/blog/supabase-point-in-time-recovery https://reeve.page/blog/supabase-point-in-time-recovery Sun, 13 Sep 2026 00:00:00 GMT Vlad Tkachenko Backups Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only. https://reeve.page/blog/supabase-project-paused-recover https://reeve.page/blog/supabase-project-paused-recover Sat, 12 Sep 2026 00:00:00 GMT Vlad Tkachenko Backups Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes. https://reeve.page/blog/safest-ai-app-builder https://reeve.page/blog/safest-ai-app-builder Fri, 11 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade. https://reeve.page/blog/enable-rls-on-every-supabase-table https://reeve.page/blog/enable-rls-on-every-supabase-table Thu, 10 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test. https://reeve.page/blog/supabase-rls-disabled-in-public https://reeve.page/blog/supabase-rls-disabled-in-public Wed, 09 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase reports "RLS disabled in public" as an error. It says nothing about the read policy that leaves your table just as open to strangers. https://reeve.page/blog/rotate-supabase-service-role-key https://reeve.page/blog/rotate-supabase-service-role-key Tue, 08 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked. https://reeve.page/blog/vibe-coding-security-scanners-compared https://reeve.page/blog/vibe-coding-security-scanners-compared Mon, 07 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics The best vibe coding security scanner comes down to three questions no feature list answers. Ten tools compared, with prices, and the jobs Reeve does not do. https://reeve.page/blog/supabase-security-checker https://reeve.page/blog/supabase-security-checker Sun, 06 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself. https://reeve.page/blog/vibe-coding-security-scanner https://reeve.page/blog/vibe-coding-security-scanner Sat, 05 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result. https://reeve.page/blog/missing-security-headers https://reeve.page/blog/missing-security-headers Fri, 04 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report. https://reeve.page/blog/openai-api-key-exposed-in-frontend https://reeve.page/blog/openai-api-key-exposed-in-frontend Thu, 03 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend. https://reeve.page/blog/what-secrets-leak-from-vibe-coded-apps https://reeve.page/blog/what-secrets-leak-from-vibe-coded-apps Wed, 02 Sep 2026 00:00:00 GMT Vlad Tkachenko Security basics An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak. https://reeve.page/blog/supabase-backup-tools-compared https://reeve.page/blog/supabase-backup-tools-compared Tue, 01 Sep 2026 00:00:00 GMT Vlad Tkachenko Backups Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included. https://reeve.page/blog/replit-secrets-explained https://reeve.page/blog/replit-secrets-explained Mon, 31 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private. https://reeve.page/blog/back-up-supabase-free-tier https://reeve.page/blog/back-up-supabase-free-tier Sun, 30 Aug 2026 00:00:00 GMT Vlad Tkachenko Backups There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out. https://reeve.page/blog/is-supabase-secure https://reeve.page/blog/is-supabase-secure Sat, 29 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin. https://reeve.page/blog/where-to-find-supabase-api-keys https://reeve.page/blog/where-to-find-supabase-api-keys Fri, 28 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app. https://reeve.page/blog/new-row-violates-row-level-security-policy https://reeve.page/blog/new-row-violates-row-level-security-policy Thu, 27 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics "New row violates row-level security policy" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone. https://reeve.page/blog/cors-wildcard-security-risk https://reeve.page/blog/cors-wildcard-security-risk Wed, 26 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked. https://reeve.page/blog/supabase-branching-is-not-a-backup https://reeve.page/blog/supabase-branching-is-not-a-backup Tue, 25 Aug 2026 00:00:00 GMT Vlad Tkachenko Backups Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead. https://reeve.page/blog/how-to-restore-a-supabase-backup https://reeve.page/blog/how-to-restore-a-supabase-backup Mon, 24 Aug 2026 00:00:00 GMT Vlad Tkachenko Backups How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes. https://reeve.page/blog/supabase-storage-bucket-public https://reeve.page/blog/supabase-storage-bucket-public Sun, 23 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings. https://reeve.page/blog/google-api-key-exposed-in-frontend https://reeve.page/blog/google-api-key-exposed-in-frontend Sat, 22 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is. https://reeve.page/blog/ai-agent-deleted-my-database https://reeve.page/blog/ai-agent-deleted-my-database Fri, 21 Aug 2026 00:00:00 GMT Vlad Tkachenko Backups An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives. https://reeve.page/blog/can-anyone-read-your-supabase-database https://reeve.page/blog/can-anyone-read-your-supabase-database Tue, 18 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes. https://reeve.page/blog/source-maps-exposed-in-production https://reeve.page/blog/source-maps-exposed-in-production Tue, 18 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public. https://reeve.page/blog/supabase-new-api-keys https://reeve.page/blog/supabase-new-api-keys Wed, 12 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does? https://reeve.page/blog/does-supabase-back-up-my-database https://reeve.page/blog/does-supabase-back-up-my-database Tue, 11 Aug 2026 00:00:00 GMT Vlad Tkachenko Backups Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive. https://reeve.page/blog/supabase-rls-on-but-table-still-public https://reeve.page/blog/supabase-rls-on-but-table-still-public Mon, 10 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in. https://reeve.page/blog/version-history-is-not-a-backup https://reeve.page/blog/version-history-is-not-a-backup Mon, 10 Aug 2026 00:00:00 GMT Vlad Tkachenko Backups Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back. https://reeve.page/blog/three-ways-to-back-up-a-supabase-database https://reeve.page/blog/three-ways-to-back-up-a-supabase-database Sun, 09 Aug 2026 00:00:00 GMT Vlad Tkachenko Backups The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account. https://reeve.page/blog/which-api-keys-are-safe-in-your-frontend https://reeve.page/blog/which-api-keys-are-safe-in-your-frontend Sun, 09 Aug 2026 00:00:00 GMT Vlad Tkachenko Security basics Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.