supabase

7 articles · newest first

Flat illustration of a person carrying a copy of a database from an empty safe to a second safe

Backups, and losing everything: the copy you'll need once

Lesson 6 of where your data lives: what a backup actually is, what your plan does and doesn't do for you, and the Replit story that made it real.

Sam Ortega · 39m ago · 4 min

Flat illustration of an open box containing a database cylinder, a key, a folder and a small server, with a person looking in

Build

What is Supabase? The backend-in-a-box, explained

Lesson 5 of where your data lives: the service behind a huge share of AI-built apps. What's inside the box, what's free, and what it asks of you.

Sam Ortega · 39m ago · 4 min

Build

What is a backend? Explained for vibe coders, with a drawing

Frontend, server, database, API, secrets: the parts of your app you can't see, drawn as the journey of one tap, and why every security rule has to live on the far side of it.

Sam Ortega · 42m ago · 6 min

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

Build

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Sam Ortega · 42m ago · 7 min

Flat illustration of two people each looking through their own window at a table, each seeing only their own coloured rows

Build

Row Level Security explained (with a picture): the setting that matters

The one database setting behind the biggest vibe-coded app exposures, shown as a table: who sees what with RLS off, who sees what with it on, and the policy your AI tool should be writing.

Sam Ortega · 42m ago · 7 min

Flat illustration of an open database cylinder with envelopes and keys floating out while a person fits a padlock

Build

The Moltbook breach: what a public Supabase key without RLS grants

An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.

Sam Ortega · 42m ago · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Sam Ortega · 42m ago · 8 min