supabase

20 articles · newest first

Flat illustration of a developer holding a laptop and scratching his head beside a giant clock showing three o'clock on an indigo background, a coral bell on top of the clock

Your scheduled job didn't run: cron on Cloudflare, Vercel, Supabase and GitHub

Most missed cron runs come down to UTC, a Sunday that is 1 on one platform and 0 on the next, or a schedule that quietly switched itself off. Here are the rules for four schedulers, from their own docs, plus the hourly job we run ourselves.

Aliteq Team · 2h ago · 11 min

Flat vector illustration of a puzzled developer holding a laptop and looking up at a giant coral pause button sitting on a frozen database cylinder, on a saturated indigo-violet background

Build

Supabase project paused? Every free tier limit, and what Pro really costs in 2026

Your vibe-coded app went quiet for a week and now it won't load. Here is every Supabase Free limit, the exact thing that breaks when you cross each one, and the real monthly bill once you upgrade.

Aliteq Team · 2h ago · 9 min

Hand-drawn editorial illustration of a uniformed doorkeeper holding up a hand mirror at an arched violet door; the mirror shows him holding a mirror, repeating into an endless tunnel, while a coral padlock hangs on the door, on a near-black background

Build

"infinite recursion detected in policy" in Supabase? Your admin check is asking itself

Your Lovable or Bolt app got an admin check, and now every read of that table fails with error 42P17. The policy is reading the table it protects, so Postgres stops the loop. The fix Supabase documents keeps RLS on and takes one small function. Plus the three quick fixes that hand your data to anyone.

Aliteq Team · 3d ago · 8 min

Hand-drawn editorial illustration of a new wooden table wrapped in a coral chain and padlock, with a hand reaching in from the side holding a small key, on a near-black background in indigo-violet and off-white

Build

"permission denied for table" in Supabase? From Oct 30, every new table needs a grant

Your vibe-coded app added a table and Supabase now answers with error 42501. A new table can be locked before Row Level Security even runs. On 30 October 2026 that becomes the rule for every existing project. The one safe fix, and the two popular fixes that open your data to anyone.

Aliteq Team · 6d ago · 8 min

Flat vector illustration of a frowning person holding up an envelope beside a giant hourglass full of coral envelopes, with only two envelopes falling through the narrow neck, on a violet background

Build

"Email rate limit exceeded" in Supabase? Its built-in email stops at 2 an hour

Your first real users try to sign up and Supabase answers with a 429. The built-in sender was never meant for production. What the limit counts, how to plug in your own sender (Resend, Postmark or Amazon SES), and the rate-limit settings to change after.

Aliteq Team · Oct 5 · 9 min

Flat illustration of a person with a magnifying glass over a wall of small identical app windows, a few marked with a coral open padlock

Build

Someone scanned 30,998 vibe-coded apps. Here's what the 57% "open Supabase" number really means.

A headline says more than half of vibe-coded apps leave their database open. The report behind it is more careful than the headline, and so is the number: what it measured, what it didn't, and the one check that matters for your app.

Aliteq Team · Oct 3 · 8 min

Hand-drawn editorial map of a vibe coder's journey from a built app to launch, with signposts along a winding path

Build

You vibe-coded an app. Here's everything to check before real people use it.

You built it by describing it to Lovable, Bolt, Cursor, Replit or v0 — the hard part's done. This is the map of the rest: understand what the AI built, fix the errors you'll Google, ship it so strangers can't break it, and handle the day a real customer shows up.

Aliteq Team · Oct 2 · 9 min

Hand-drawn editorial illustration of a solid stone foundation stamped with a teal seal, carrying a small violet wooden house whose front door stands open with the key still in the lock

Security

A Buyer Asked if Your Lovable App Is SOC 2. What Your Platforms' Reports Don't Cover

You built it vibe coding on Lovable, Bolt, Replit or v0, with Supabase and Vercel underneath, and a security questionnaire just asked for SOC 2. Each platform's own report, how to get it, which plan it sits behind, whether it trains on your data, and the half of the audit that is still yours.

Aliteq Team · Sep 27 · 12 min

Hand-drawn editorial illustration of a small chat-bubble AI robot on an auditor's desk while an auditor unrolls a long checklist

Security

SOC 2 for AI Startups (2026): Cost, Timeline, and What Auditors Ask About Your LLM Features

Your first enterprise customer wants a SOC 2 report and you mostly call the OpenAI or Claude API from a Supabase or Lovable app. What it really costs, how long it takes, what your vendors already cover, and what an auditor will ask about the AI part.

Aliteq Team · Sep 27 · 14 min

Flat illustration of a person holding two keys, a small public one and a large master key kept in a pocket

Build

Your Supabase anon key is visible in the browser. Is that a problem?

Short version: the anon (publishable) key is meant to be public — as long as Row Level Security is on. The key that must never leak is the other one. Here's how to tell which you're looking at.

Aliteq Team · Sep 26 · 6 min

Editorial illustration of a document being turned away at a guarded doorway into a filing cabinet

Build

Your app says "new row violates row-level security policy". Here's what it's protecting.

It's not a bug — it's your database refusing to let the wrong person write a row. Why the error shows up the moment security is on, and the right way to fix it (never "disable RLS").

Aliteq Team · Sep 26 · 6 min

Isometric diorama of a grid of table rows each with its own small lock, one row highlighted, near-black background with indigo-violet and a coral accent

Build

"Write the RLS policy for my users table": three prompts, three outcomes

Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's the request three ways, with the real SQL each produced.

Aliteq Team · Sep 26 · 6 min

Isometric diorama of a glowing key turning in a login card, near-black background, indigo-violet with a small coral accent

Build

"Add login with Supabase": the same prompt, three ways

Every vibe coder types "add login with Supabase" and gets working code. Here's what changes when you ask for it vaguely, specifically, and with the guardrails spelled out — with the real code each version produced.

Aliteq Team · Sep 26 · 6 min

Flat illustration of a person carrying a copy of a database from an empty safe to a second safe

Build

AI deleted my database. Can I get it back?

It happened to a Replit user in 2025 and to a Cursor user in 2026. What to check in the first ten minutes, why Lovable's and Replit's undo buttons don't bring data back by default, and the backup habit that does.

Aliteq Team · Sep 25 · 6 min

Flat illustration of an open box containing a database cylinder, a key, a folder and a small server, with a person looking in

Build

Supabase: the backend-in-a-box behind so many AI-built apps

A hosted database, login, an automatic API and file storage in one box. What's inside, what the free plan covers, and the one setting it asks you to get right.

Aliteq Team · Sep 25 · 4 min

Build

The half of your app you can't see — and why every security rule has to live there

Frontend, server, database, API, secrets: the parts behind the glass, drawn as the journey of one tap, and why the safety checks can only work on the far side of it. Tap to follow it.

Aliteq Team · Sep 25 · 6 min

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

BuildInteractive

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Aliteq Team · Sep 25 · 7 min

Flat illustration of two people each looking through their own window at a table, each seeing only their own coloured rows

BuildInteractive

Your Lovable app might be showing everyone's data — one setting fixes it

The single database setting behind the biggest vibe-coded app leaks, shown as a who-can-see-what table you can toggle: data wide open, then locked to its owner. The policy your AI tool should be writing.

Aliteq Team · Sep 25 · 7 min

Flat illustration of an open database cylinder with envelopes and keys floating out while a person fits a padlock

Build

The Moltbook breach: what a public Supabase key without RLS grants

An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.

Aliteq Team · Sep 25 · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Aliteq Team · Sep 25 · 8 min