supabase

16 articles · newest first

Flat vector illustration of a frowning person holding up an envelope beside a giant hourglass full of coral envelopes, with only two envelopes falling through the narrow neck, on a violet background

"Email rate limit exceeded" in Supabase? Its built-in email stops at 2 an hour

Your first real users try to sign up and Supabase answers with a 429. The built-in sender was never meant for production. What the limit counts, how to plug in your own sender (Resend, Postmark or Amazon SES), and the rate-limit settings to change after.

Syntax · 2d ago · 9 min

Flat illustration of a person with a magnifying glass over a wall of small identical app windows, a few marked with a coral open padlock

Build

Someone scanned 30,998 vibe-coded apps. Here's what the 57% "open Supabase" number really means.

A headline says more than half of vibe-coded apps leave their database open. The report behind it is more careful than the headline, and so is the number: what it measured, what it didn't, and the one check that matters for your app.

Syntax · 4d ago · 8 min

Hand-drawn editorial map of a vibe coder's journey from a built app to launch, with signposts along a winding path

Build

You vibe-coded an app. Here's everything to check before real people use it.

You built it by describing it to Lovable, Bolt, Cursor, Replit or v0 — the hard part's done. This is the map of the rest: understand what the AI built, fix the errors you'll Google, ship it so strangers can't break it, and handle the day a real customer shows up.

Syntax · 4d ago · 9 min

Hand-drawn editorial illustration of a solid stone foundation stamped with a teal seal, carrying a small violet wooden house whose front door stands open with the key still in the lock

Security

A Buyer Asked if Your Lovable App Is SOC 2. What Your Platforms' Reports Don't Cover

You built it vibe coding on Lovable, Bolt, Replit or v0, with Supabase and Vercel underneath, and a security questionnaire just asked for SOC 2. Each platform's own report, how to get it, which plan it sits behind, whether it trains on your data, and the half of the audit that is still yours.

Cipher · Sep 27 · 12 min

Hand-drawn editorial illustration of a small chat-bubble AI robot on an auditor's desk while an auditor unrolls a long checklist

Security

SOC 2 for AI Startups (2026): Cost, Timeline, and What Auditors Ask About Your LLM Features

Your first enterprise customer wants a SOC 2 report and you mostly call the OpenAI or Claude API from a Supabase or Lovable app. What it really costs, how long it takes, what your vendors already cover, and what an auditor will ask about the AI part.

Cipher · Sep 27 · 14 min

Flat illustration of a person holding two keys, a small public one and a large master key kept in a pocket

Build

Your Supabase anon key is visible in the browser. Is that a problem?

Short version: the anon (publishable) key is meant to be public — as long as Row Level Security is on. The key that must never leak is the other one. Here's how to tell which you're looking at.

Syntax · Sep 26 · 6 min

Editorial illustration of a document being turned away at a guarded doorway into a filing cabinet

Build

Your app says "new row violates row-level security policy". Here's what it's protecting.

It's not a bug — it's your database refusing to let the wrong person write a row. Why the error shows up the moment security is on, and the right way to fix it (never "disable RLS").

Syntax · Sep 26 · 6 min

Isometric diorama of a grid of table rows each with its own small lock, one row highlighted, near-black background with indigo-violet and a coral accent

Build

"Write the RLS policy for my users table": three prompts, three outcomes

Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's the request three ways, with the real SQL each produced.

Syntax · Sep 26 · 6 min

Isometric diorama of a glowing key turning in a login card, near-black background, indigo-violet with a small coral accent

Build

"Add login with Supabase": the same prompt, three ways

Every vibe coder types "add login with Supabase" and gets working code. Here's what changes when you ask for it vaguely, specifically, and with the guardrails spelled out — with the real code each version produced.

Syntax · Sep 26 · 6 min

Flat illustration of a person carrying a copy of a database from an empty safe to a second safe

Build

AI deleted my database. Can I get it back?

It happened to a Replit user in 2025 and to a Cursor user in 2026. What to check in the first ten minutes, why Lovable's and Replit's undo buttons don't bring data back by default, and the backup habit that does.

Syntax · Sep 25 · 6 min

Flat illustration of an open box containing a database cylinder, a key, a folder and a small server, with a person looking in

Build

Supabase: the backend-in-a-box behind so many AI-built apps

A hosted database, login, an automatic API and file storage in one box. What's inside, what the free plan covers, and the one setting it asks you to get right.

Syntax · Sep 25 · 4 min

Build

The half of your app you can't see — and why every security rule has to live there

Frontend, server, database, API, secrets: the parts behind the glass, drawn as the journey of one tap, and why the safety checks can only work on the far side of it. Tap to follow it.

Syntax · Sep 25 · 6 min

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

BuildInteractive

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Syntax · Sep 25 · 7 min

Flat illustration of two people each looking through their own window at a table, each seeing only their own coloured rows

BuildInteractive

Your Lovable app might be showing everyone's data — one setting fixes it

The single database setting behind the biggest vibe-coded app leaks, shown as a who-can-see-what table you can toggle: data wide open, then locked to its owner. The policy your AI tool should be writing.

Syntax · Sep 25 · 7 min

Flat illustration of an open database cylinder with envelopes and keys floating out while a person fits a padlock

Build

The Moltbook breach: what a public Supabase key without RLS grants

An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.

Syntax · Sep 25 · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Syntax · Sep 25 · 8 min