[{"data":1,"prerenderedAt":1519},["ShallowReactive",2],{"\u002Fblog\u002Fbolt-app-rescue-2026\u002F":3,"\u002Fblog\u002Fbolt-app-rescue-2026\u002F-related":362,"\u002Fblog\u002Fbolt-app-rescue-2026\u002F-resources":1503},{"id":4,"title":5,"author":6,"body":10,"category":268,"checker":269,"createdAt":270,"description":271,"disclosure":272,"extension":273,"faq":274,"howTo":272,"lastVerified":290,"location":291,"meta":292,"navigation":298,"ogImage":272,"path":299,"primaryKeyword":300,"readingTime":301,"related":302,"seo":305,"sources":306,"stem":352,"tags":353,"takeaways":354,"updatedAt":270,"url":360,"__hash__":361},"blog\u002Fblog\u002Fbolt-app-rescue-2026.md","Bolt App Rescue: 8 Problems to Fix Before Launch",{"name":7,"social":8},"Simon Dziak",{"twitter":9},"@SzymonDziak",{"type":11,"value":12,"toc":254},"minimark",[13,26,29,34,37,43,49,53,56,76,81,85,92,97,102,106,109,114,119,123,126,131,136,140,143,148,153,157,160,165,170,174,181,186,191,195,214,218],[14,15,16,20,21,25],"p",{},[17,18,19],"strong",{},"Problems with real Bolt apps often show up in a handful of places Bolt's own documentation already warns about: database access rules, secret keys, sign-in emails, publishing and hosting limits."," Bolt builds your app from a prompt, publishes it on Bolt's own hosting at a ",[22,23,24],"code",{},"bolt.host"," address, and stores data in Bolt Database, which you can later claim into your own Supabase account, or in a Supabase project you choose on a paid plan. The free scan at the end of this page works for Supabase projects only.",[14,27,28],{},"Below are the eight problems to check before launch, how to test each one, and how to fix it. The facts come from Bolt's help center and Supabase's documentation, and I re-read each source on October 20, 2026. Bolt's public GitHub repository has issues turned off, so this page relies on what Bolt documents, not on complaint counts. The how-to-check and how-to-fix steps are my own advice.",[30,31,33],"h2",{"id":32},"_1-database-tables-anyone-can-read-or-change","1. Database tables anyone can read or change",[14,35,36],{},"Bolt's database security page puts it plainly: \"A table without RLS can be read and changed by anyone.\" It also warns that when you haven't asked for sign-in, \"Bolt might write policies that allow any visitor to view, add, change, and delete the data in your database.\" Row-level security (RLS) is what decides which rows each visitor can reach.",[14,38,39,42],{},[17,40,41],{},"How to check:"," open the database's Security tab, which Bolt says \"uses the same database checks as the Security Advisor in Supabase\", and look for warnings about policies that are always true or tables without RLS. Then test as a logged-out visitor, and as one user trying to reach another user's rows. The free scan at the end of this page works only if your app uses a Supabase project (a supabase.co address and a public key your site ships). If your app is on Bolt Database, use the Security tab and the logged-out test above instead.",[14,44,45,48],{},[17,46,47],{},"How to fix:"," add real sign-in first, then rewrite each table's policies: read-only for public content, insert-only for forms, owner-only for private data. Turn RLS on for every table and re-run the check.",[30,50,52],{"id":51},"_2-secret-keys-in-front-end-code","2. Secret keys in front-end code",[14,54,55],{},"A Bolt app's front end runs in each visitor's browser, so a key placed there is public. Bolt's security audit checks that private keys and passwords \"aren't stored in your project's code or sent to visitors' browsers\", and its secrets guide says: \"Never store secrets in plain text in your code.\" A leaked Supabase secret key bypasses every access rule. A leaked payment, email or AI key can be used on your bill.",[14,57,58,60,61,64,65,64,68,71,72,75],{},[17,59,41],{}," search the code for ",[22,62,63],{},"sk_",", ",[22,66,67],{},"service_role",[22,69,70],{},"sb_secret_"," and your providers' key prefixes, including any ",[22,73,74],{},"VITE_"," variables, and look at the JavaScript your live site loads.",[14,77,78,80],{},[17,79,47],{}," rotate any key that ever appeared in code, store it in the database's Secrets, and call the provider from a server function instead of the browser.",[30,82,84],{"id":83},"_3-sign-up-and-password-reset-links-that-break-on-the-live-site","3. Sign-up and password-reset links that break on the live site",[14,86,87,88,91],{},"Bolt's authentication guide says: \"By default, Bolt projects use ",[22,89,90],{},"localhost:3000"," as the Site URL. This does not work for live applications.\" Redirects also only work for addresses on the URI Allow List. And for emails to send at all, Bolt says \"you still need to add your own Resend API key\".",[14,93,94,96],{},[17,95,41],{}," on the live site, sign up with a fresh address, click the link in the email, and run Forgot password from start to finish.",[14,98,99,101],{},[17,100,47],{}," set the Site URL to your live domain, add every domain and reset page to the URI Allow List (again after you attach a custom domain), and add your email provider's key.",[30,103,105],{"id":104},"_4-the-live-site-doesnt-match-the-preview","4. The live site doesn't match the preview",[14,107,108],{},"Bolt's publishing guide says \"changes you make to your Bolt project aren't automatically applied to your published site.\" Fixing something in the editor and seeing it work in the preview doesn't mean customers see it.",[14,110,111,113],{},[17,112,41],{}," open the live URL in a private window after every change and compare it with the preview. In the Publish menu, look for a pending update.",[14,115,116,118],{},[17,117,47],{}," publish an update after each change, then run a short checklist on the live URL: sign-up, sign-in, payment and email.",[30,120,122],{"id":121},"_5-the-site-goes-offline-at-the-hosting-limit-or-wont-publish","5. The site goes offline at the hosting limit, or won't publish",[14,124,125],{},"On Bolt's hosting plans, \"Free plan sites stop serving content once they hit their monthly data limits,\" and if you publish several sites, \"they share the same monthly bandwidth and request allowance.\" Separately, publishing fails above a size cap: \"The maximum allowed size is 100MB.\"",[14,127,128,130],{},[17,129,41],{}," look at usage and the spending limit in your account settings before a launch, and check how much of your project's size is images and video.",[14,132,133,135],{},[17,134,47],{}," move to a paid plan with a spending limit before launch day, and move large media to external storage so the project stays well under the cap.",[30,137,139],{"id":138},"_6-undo-doesnt-undo-your-data","6. Undo doesn't undo your data",[14,141,142],{},"Bolt's backup guide says \"Restoring to an earlier project version will not change your current Bolt or Supabase databases.\" After a bad change, the old code can end up running against newer tables. Bolt also warns that connecting a Supabase database to a project that already has a Bolt database \"will replace the connection, which may cause data loss\", and that there is \"no supported way to migrate an existing Bolt database to Supabase\" other than claiming it.",[14,144,145,147],{},[17,146,41],{}," confirm the project is on GitHub, confirm which database the live app really uses, and try exporting your tables.",[14,149,150,152],{},[17,151,47],{}," export your data and connect GitHub before launch. If you need your own Supabase account for backups and SQL access, claim the Bolt database rather than connecting a new one to a project that holds data.",[30,154,156],{"id":155},"_7-files-anyone-with-the-link-can-open","7. Files anyone with the link can open",[14,158,159],{},"Bolt's file storage guide explains that in a public bucket, \"Anyone with the link can see these files, even if they're not signed in to your app,\" and tells you to \"Always confirm a bucket's visibility yourself.\" User uploads such as IDs, invoices and photos belong in private buckets.",[14,161,162,164],{},[17,163,41],{}," in File Storage, read whether each bucket is public or private, and open a user's file URL in a private window.",[14,166,167,169],{},[17,168,47],{}," make user-upload buckets private, add per-user storage policies, and serve files through signed links. Then test again with two accounts.",[30,171,173],{"id":172},"_8-fix-loops-that-spend-your-budget","8. Fix loops that spend your budget",[14,175,176,177,180],{},"When an error won't go away, each attempt is another AI edit. Bolt's own advice is to \"Avoid clicking ",[17,178,179],{},"Attempt fix"," over and over, hoping for things to eventually work out.\" Repeated attempts change more code, spend tokens, and can leave the app half-fixed.",[14,182,183,185],{},[17,184,41],{}," count how many fix attempts in a row went into one error, and whether the files being edited have grown very large.",[14,187,188,190],{},[17,189,47],{}," stop, read the real error in the browser console, ask for one change at a time, split large files, or hand the code to a developer with the exact error.",[30,192,194],{"id":193},"what-to-do-this-week","What to do this week",[196,197,198,202,205,208,211],"ol",{},[199,200,201],"li",{},"If your app runs on a Supabase project, run the free leak scan below against your live site. If it uses Bolt Database, test the live site as a logged-out visitor.",[199,203,204],{},"Fix the Site URL and test sign-up and password reset on the live domain.",[199,206,207],{},"Search the code for secret keys and rotate anything you find.",[199,209,210],{},"Check every storage bucket's visibility.",[199,212,213],{},"Export your data and connect GitHub before launch day.",[30,215,217],{"id":216},"need-a-hand","Need a hand?",[14,219,220,221,226,227,64,231,64,235,64,239,243,244,248,249,253],{},"If you'd rather have someone else check it, the ",[222,223,225],"a",{"href":224},"\u002Ffixed-price\u002Fai-app-rescue\u002F","AI-Built App Rescue"," starts with a $450 Launch Check. You send read-only access, and within 3 business days you get each problem ranked by severity, with where it is and how it was confirmed, plus a fixed price for the Rescue Sprint. The $450 is credited if you go ahead, and you keep the code either way. Built with something else? See the ",[222,228,230],{"href":229},"\u002Fblog\u002Flovable-app-rescue-2026\u002F","Lovable",[222,232,234],{"href":233},"\u002Fblog\u002Freplit-app-rescue-2026\u002F","Replit",[222,236,238],{"href":237},"\u002Fblog\u002Fcursor-app-rescue-2026\u002F","Cursor",[222,240,242],{"href":241},"\u002Fblog\u002Fbase44-app-rescue-2026\u002F","Base44"," and ",[222,245,247],{"href":246},"\u002Fblog\u002Fv0-app-rescue-2026\u002F","v0"," checklists. Or ",[222,250,252],{"href":251},"\u002Fcontact\u002F","send me a short description",".",{"title":255,"searchDepth":256,"depth":256,"links":257},"",2,[258,259,260,261,262,263,264,265,266,267],{"id":32,"depth":256,"text":33},{"id":51,"depth":256,"text":52},{"id":83,"depth":256,"text":84},{"id":104,"depth":256,"text":105},{"id":121,"depth":256,"text":122},{"id":138,"depth":256,"text":139},{"id":155,"depth":256,"text":156},{"id":172,"depth":256,"text":173},{"id":193,"depth":256,"text":194},{"id":216,"depth":256,"text":217},"AI & Technology","supabase-leak-scan","2026-10-20T10:00:00.000Z","Your Bolt app works in the preview but real users are coming. The 8 problems to check first, from open database tables and broken sign-up links to hosting limits and fix loops, with how to test and fix each one.",null,"md",[275,278,281,284,287],{"question":276,"answer":277},"Is my Bolt app secure if the security audit passes?","The audit is a good start, but Bolt itself tells you to confirm some settings by hand, such as whether each storage bucket is public. Test as a logged-out visitor and with two accounts before launch.",{"question":279,"answer":280},"Why do my Bolt app's sign-up emails link to localhost?","Bolt projects use localhost:3000 as the default Site URL, which does not work for live apps. Set the Site URL to your live domain and add every domain and reset page to the URI Allow List in the database authentication settings.",{"question":282,"answer":283},"Why does my published Bolt site still show the old version?","Publishing is a separate step. Changes in the editor are not applied to the live site until you publish an update from the Publish menu, so always test the live URL after each publish.",{"question":285,"answer":286},"Can I move my Bolt app to Supabase or another host?","Bolt says there is no supported way to migrate an existing Bolt database to Supabase, other than claiming the database into your own Supabase account. Bolt warns that connecting a Supabase database to a project that already has a Bolt database may cause data loss, so export first.",{"question":288,"answer":289},"Do I own the code Bolt writes?","Yes. Bolt says code you create with Bolt and StackBlitz is your own and can be used for commercial purposes. Connect the project to GitHub so a developer can work on it outside Bolt.","2026-10-20","Boynton Beach, FL",{"readingTimeStats":293},{"text":294,"minutes":295,"time":296,"words":297},"7 min read",6.495,389700,1299,true,"\u002Fblog\u002Fbolt-app-rescue-2026","bolt app rescue","8 min",[303,304],"lovable-app-rescue-2026","supabase-permission-denied-new-tables-october-30-2026",{"title":5,"description":271},[307,310,313,316,319,322,325,328,331,334,337,340,343,346,349],{"title":308,"url":309},"Bolt docs, Database security","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fsecurity",{"title":311,"url":312},"Bolt docs, Security audit","https:\u002F\u002Fsupport.bolt.new\u002Fbuilding\u002Fsecurity",{"title":314,"url":315},"Bolt docs, Database authentication","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fauthentication",{"title":317,"url":318},"Bolt docs, Send emails","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fsend-emails",{"title":320,"url":321},"Bolt docs, Publish","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fhosting\u002Fpublish",{"title":323,"url":324},"Bolt docs, Hosting plans","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fhosting\u002Fplans",{"title":326,"url":327},"Bolt docs, Publish issues","https:\u002F\u002Fsupport.bolt.new\u002Ftroubleshooting\u002Fpublish-issues",{"title":329,"url":330},"Bolt docs, Rollback and backup","https:\u002F\u002Fsupport.bolt.new\u002Fmanaging-projects\u002Frollback-backup",{"title":332,"url":333},"Bolt docs, Bolt Database","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase",{"title":335,"url":336},"Bolt docs, File storage","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Ffile-storage",{"title":338,"url":339},"Bolt docs, Maximizing token efficiency","https:\u002F\u002Fsupport.bolt.new\u002Fprompting\u002Fmaximizing-token-efficiency",{"title":341,"url":342},"Bolt docs, Database secrets","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fsecrets",{"title":344,"url":345},"Bolt docs, Advanced database settings","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fadvanced",{"title":347,"url":348},"Bolt docs, Corporate and commercial","https:\u002F\u002Fsupport.bolt.new\u002Faccount\u002Fcorporate-commercial",{"title":350,"url":351},"Supabase docs, Row Level Security","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fpostgres\u002Frow-level-security","blog\u002Fbolt-app-rescue-2026","bolt app rescue, fix bolt app, bolt.new security, bolt database rls, bolt cloud, bolt.new production, ai app rescue, vibe coded app, supabase row level security",[355,356,357,358,359],"Bolt's own docs warn that \"a table without RLS can be read and changed by anyone,\" and that if you haven't asked for sign-in, Bolt may write policies that let any visitor view, add, change and delete data.","Sign-up and password-reset emails break on the live site until you change the default Site URL, which Bolt sets to localhost:3000.","Publishing is a manual step: changes in the preview \"aren't automatically applied to your published site.\"","Restoring an earlier version does not change your Bolt or Supabase database, so the old code can end up running against newer data.","Free plan sites stop serving once they hit the monthly hosting limit, and that limit is shared by every site on your account.","https:\u002F\u002Fapp369.com\u002Fblog\u002Fbolt-app-rescue-2026\u002F","z7-mu7drJpViJ8r3VnA_p-ITxVyU9lkJ6xpthwRNbfY",[363,709],{"id":364,"title":365,"author":366,"body":368,"category":268,"checker":269,"createdAt":639,"description":640,"disclosure":272,"extension":273,"faq":641,"howTo":272,"lastVerified":290,"location":291,"meta":657,"navigation":298,"ogImage":272,"path":662,"primaryKeyword":663,"readingTime":301,"related":664,"seo":666,"sources":667,"stem":699,"tags":700,"takeaways":701,"updatedAt":639,"url":707,"__hash__":708},"blog\u002Fblog\u002Flovable-app-rescue-2026.md","Lovable App Rescue: 7 Problems to Fix Before Launch",{"name":7,"social":367},{"twitter":9},{"type":11,"value":369,"toc":628},[370,376,379,383,390,406,411,420,424,427,432,437,441,447,460,465,469,476,489,494,498,501,506,523,527,530,533,548,553,557,560,581,584,589,591,608,610],[14,371,372,375],{},[17,373,374],{},"Problems with real Lovable apps often show up in the same few places: database access rules, keys in the browser, server functions that don't check the caller, and the gap between the preview and the live app."," A Lovable app is a React front end that talks to a Supabase database, either Lovable Cloud (which Lovable says uses \"Supabase's open-source foundation\") or a Supabase project you connect. The browser calls the database directly with a public key, so the database rules are what keep one user's data away from another.",[14,377,378],{},"Below are the seven problems to check before launch, how to test each one in a few minutes, and how to fix it. The facts below come from Lovable's and Supabase's own documentation and from the public security report on Lovable apps, and I re-read each source on October 20, 2026. The how-to-check and how-to-fix steps are my own advice.",[30,380,382],{"id":381},"_1-tables-anyone-can-read-or-change","1. Tables anyone can read or change",[14,384,385,386,389],{},"Lovable's Supabase guide is blunt: \"Missing RLS policies are the most common way app data gets exposed.\" A table in the public schema with row-level security (RLS) turned off, or with a policy like ",[22,387,388],{},"USING (true)",", can be read, and often changed, by anyone who has your app's public key. That key ships in your site's JavaScript by design.",[14,391,392,393,399,400,405],{},"This is not a hypothetical. ",[222,394,398],{"href":395,"rel":396},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48757",[397],"nofollow","CVE-2025-48757"," describes \"an insufficient database Row-Level Security policy in Lovable through 2025-04-15\" that, per the CVE text, allows unauthenticated attackers to read or write tables of generated sites. The entry is marked as disputed by Lovable, because each customer is responsible for protecting their own app's data. The researchers who filed it ",[222,401,404],{"href":402,"rel":403},"https:\u002F\u002Fmattpalmer.io\u002Fposts\u002Fstatement-on-CVE-2025-48757\u002F",[397],"report"," that their own March 2025 scan, which predates Lovable's current Quick and Deep scans, found 303 endpoints across 170 projects, about 10.3% of the 1,645 they analyzed, with inadequate RLS settings.",[14,407,408,410],{},[17,409,41],{}," open Supabase's Security Advisor and look for \"RLS disabled in public\" and \"policy exists, RLS disabled\". Then request each table with only the public key and no login. The free scan at the end of this page does that for you.",[14,412,413,415,416,419],{},[17,414,47],{}," turn on RLS for every table in the public schema and write policies that tie rows to ",[22,417,418],{},"auth.uid()",". Remove any policy that lets everyone in.",[30,421,423],{"id":422},"_2-a-green-scan-with-the-wrong-policies","2. A green scan with the wrong policies",[14,425,426],{},"Lovable's Quick scan \"runs automatically every time you publish\" and checks things like tables without RLS. A table can have a policy and still let the wrong people in. The CVE researchers said in 2025 that the scanner they tested only checked that a policy existed, \"not its correctness\". Lovable's current Quick scan reviews database access rules, for example tables without per-record access control, but it is still a fixed set of checks. Lovable itself says its tools \"cannot guarantee complete security\".",[14,428,429,431],{},[17,430,41],{}," Lovable's own best-practice guide says to \"sign in as a second user and confirm you cannot see or change the first user's data.\" Do that for every screen that shows private data, and repeat it for each role your app has.",[14,433,434,436],{},[17,435,47],{}," rewrite any policy that fails the two-user test, then test reads, inserts, updates and deletes separately. A policy that blocks reads can still allow writes.",[30,438,440],{"id":439},"_3-secret-keys-in-the-browser","3. Secret keys in the browser",[14,442,443,444,446],{},"Lovable's security docs explain that it \"generates frontend code that runs in the browser, which means API keys and other secrets cannot be stored safely in client-side code.\" Supabase says the same about its secret and ",[22,445,67],{}," keys: never put one in a browser, a shipped app or source control. Stripe secret keys, AI provider keys and admin keys belong in the same category.",[14,448,449,451,452,64,454,64,456,459],{},[17,450,41],{}," search your GitHub repository and the built JavaScript for ",[22,453,67],{},[22,455,70],{},[22,457,458],{},"sk_live"," and your providers' key prefixes.",[14,461,462,464],{},[17,463,47],{}," rotate any secret that was ever exposed, then move the call into a server function that reads the key from Lovable's Secrets. Only the publishable or anon key belongs in the browser.",[30,466,468],{"id":467},"_4-server-functions-that-dont-check-who-is-calling","4. Server functions that don't check who is calling",[14,470,471,472,475],{},"Payments, emails, AI calls and admin actions usually run in Supabase Edge Functions that Lovable writes for you. A function that uses the service key skips RLS entirely, so it has to check the caller itself. Supabase's default is ",[22,473,474],{},"verify_jwt = true",", so \"the platform validates the JWT before your handler runs\", and it warns against turning that off just to clear an error.",[14,477,478,480,481,484,485,488],{},[17,479,41],{}," call each function with no token, then with a normal user's token for an action only an admin should take. Look for ",[22,482,483],{},"verify_jwt = false"," in ",[22,486,487],{},"supabase\u002Fconfig.toml",". Lovable's Deep scan reviews this kind of access control in your code, but \"the Deep scan does not run automatically\", so run it yourself.",[14,490,491,493],{},[17,492,47],{}," keep JWT verification on for anything a user triggers, check the user's role and ownership inside the function, and verify webhook signatures for calls from Stripe or other services.",[30,495,497],{"id":496},"_5-views-and-storage-that-skip-your-rules","5. Views and storage that skip your rules",[14,499,500],{},"Locking down a table is not enough if a view or a storage bucket exposes the same data. Supabase's advisor warns that a security definer view \"runs with elevated privileges and ignores Row-Level Security\". Files in a public storage bucket can be opened by anyone with the link.",[14,502,503,505],{},[17,504,41],{}," in the Security Advisor, look for \"security definer view\" and \"auth users exposed\". In Storage, list which buckets are public.",[14,507,508,510,511,514,515,518,519,522],{},[17,509,47],{}," recreate views with ",[22,512,513],{},"security_invoker = on",", copy the user fields you need into a ",[22,516,517],{},"profiles"," table instead of exposing ",[22,520,521],{},"auth.users",", and make buckets with private files private, with storage policies.",[30,524,526],{"id":525},"_6-the-supabase-october-30-2026-change","6. The Supabase October 30, 2026 change",[14,528,529],{},"Supabase has made \"no automatic grants\" the default for new projects since May 30, 2026, and applies it to all existing projects on October 30, 2026. Once it applies to your project, a new table in the public schema fails with \"permission denied for table\" until a migration grants it. Supabase also says \"existing tables are not affected\", so a table that is open today stays open.",[14,531,532],{},"If your Lovable app uses a Supabase project you own, the change applies. Lovable's docs don't say whether Lovable Cloud follows the same default or adds grants to the migrations it writes, so after October 30, create a test table and check it from the app.",[14,534,535,537,538,542,543,547],{},[17,536,41],{}," paste your migrations into the free ",[222,539,541],{"href":540},"\u002Ftools\u002Fsupabase-oct-30-checker\u002F","Supabase October 30 grants checker",". The ",[222,544,546],{"href":545},"\u002Fblog\u002Fsupabase-permission-denied-new-tables-october-30-2026\u002F","full guide to the change"," has the exact grant lines.",[14,549,550,552],{},[17,551,47],{}," add a grant per role in the same migration that creates each table, next to RLS and its policies.",[30,554,556],{"id":555},"_7-no-safe-path-between-the-preview-and-production","7. No safe path between the preview and production",[14,558,559],{},"Three facts from Lovable's docs catch teams out once real users arrive:",[561,562,563,569,575],"ul",{},[199,564,565,568],{},[17,566,567],{},"Reverting doesn't undo data changes."," Lovable's guide says \"reverting restores your code, not your database data\". A bad migration or a test that wrote to the live database stays in the database.",[199,570,571,574],{},[17,572,573],{},"The live site is a snapshot."," It only changes when you publish again, so the preview and the live app can drift apart.",[199,576,577,580],{},[17,578,579],{},"GitHub sync has limits."," \"Lovable only edits and syncs one branch at a time\", and \"Git sync always creates a new repository\", so you can't attach a project to an existing repository. Two people, or Lovable and a local editor, pushing to the same branch can overwrite each other's work.",[14,582,583],{},"Moving off Lovable Cloud is possible but manual, and removing Cloud \"permanently deletes your Cloud instance and cannot be undone\", so export your database and files first.",[14,585,586,588],{},[17,587,47],{}," export and test a database backup before launch, keep schema changes in migrations in the repository, agree who pushes to the synced branch, and run payments in test mode until the two-user test passes.",[30,590,194],{"id":193},[196,592,593,596,599,602,605],{},[199,594,595],{},"Run the free leak scan below against your live site.",[199,597,598],{},"Do the two-user test on every page with private data.",[199,600,601],{},"Search your repository for secret keys and rotate anything you find.",[199,603,604],{},"Run Lovable's Deep scan and read every finding.",[199,606,607],{},"Check your newest migrations for grants before October 30.",[30,609,217],{"id":216},[14,611,220,612,226,614,64,618,64,620,64,622,243,624,248,626,253],{},[222,613,225],{"href":224},[222,615,617],{"href":616},"\u002Fblog\u002Fbolt-app-rescue-2026\u002F","Bolt",[222,619,234],{"href":233},[222,621,238],{"href":237},[222,623,242],{"href":241},[222,625,247],{"href":246},[222,627,252],{"href":251},{"title":255,"searchDepth":256,"depth":256,"links":629},[630,631,632,633,634,635,636,637,638],{"id":381,"depth":256,"text":382},{"id":422,"depth":256,"text":423},{"id":439,"depth":256,"text":440},{"id":467,"depth":256,"text":468},{"id":496,"depth":256,"text":497},{"id":525,"depth":256,"text":526},{"id":555,"depth":256,"text":556},{"id":193,"depth":256,"text":194},{"id":216,"depth":256,"text":217},"2026-10-20T09:00:00.000Z","Your Lovable app works in the preview but real users are coming. The 7 problems to check first, from open tables to edge functions and the Supabase October 30 change, with how to test and fix each one.",[642,645,648,651,654],{"question":643,"answer":644},"Is my Lovable app secure if the security scan passes?","Not necessarily. Lovable says its scans \"cannot guarantee complete security\", and the Quick scan that runs on publish does not review your app code. Run the Deep scan and test access yourself with two accounts and with no login.",{"question":646,"answer":647},"Why can other users see each other's data in my Lovable app?","Usually because a table has row-level security turned off, or a policy that lets everyone in, such as USING (true). The browser talks to the database with a public key, so the policies are the only thing deciding who sees which rows.",{"question":649,"answer":650},"Will the Supabase October 30, 2026 change break my Lovable app?","Existing tables keep working. Once the change applies to your project (new projects since May 30, 2026, all existing projects on October 30, 2026), new tables return \"permission denied\" until a migration grants them to the right roles. If your app uses a Supabase project you own, the change applies. Lovable's docs don't say how Lovable Cloud handles it, so test a new table after that date.",{"question":652,"answer":653},"Can I move my Lovable app off Lovable Cloud?","Yes, but it is manual. You export your data and files, connect your own Supabase project and rebuild the schema. Lovable says removing Cloud \"permanently deletes your Cloud instance and cannot be undone\", so export first.",{"question":655,"answer":656},"Do I keep my code if I hire someone to fix my Lovable app?","Yes. Lovable syncs your project to a GitHub repository you own, and a developer can work from that repository. Lovable only syncs one branch at a time, so agree on which branch Lovable edits before anyone else pushes to it.",{"readingTimeStats":658},{"text":294,"minutes":659,"time":660,"words":661},6.9,414000,1380,"\u002Fblog\u002Flovable-app-rescue-2026","lovable app rescue",[304,665],"firebase-security-guide-2026",{"title":365,"description":640},[668,671,674,677,680,683,685,687,690,693,696],{"title":669,"url":670},"Lovable docs, Security","https:\u002F\u002Fdocs.lovable.dev\u002Ffeatures\u002Fsecurity",{"title":672,"url":673},"Lovable docs, Supabase integration","https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fsupabase",{"title":675,"url":676},"Lovable docs, Lovable Cloud","https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fcloud",{"title":678,"url":679},"Lovable docs, GitHub integration","https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fgithub",{"title":681,"url":682},"Lovable docs, Best practices","https:\u002F\u002Fdocs.lovable.dev\u002Ftips-tricks\u002Fbest-practice",{"title":684,"url":395},"NVD, CVE-2025-48757",{"title":686,"url":402},"Matt Palmer, Statement on CVE-2025-48757",{"title":688,"url":689},"Supabase changelog, tables not exposed to the Data API automatically","https:\u002F\u002Fsupabase.com\u002Fchangelog\u002F45329-breaking-change-tables-not-exposed-to-data-and-graphql-api-automatically",{"title":691,"url":692},"Supabase docs, Database advisors","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fdatabase-advisors",{"title":694,"url":695},"Supabase docs, API keys","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fapi\u002Fapi-keys",{"title":697,"url":698},"Supabase docs, Edge Functions auth","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Fauth","blog\u002Flovable-app-rescue-2026","lovable app rescue, fix lovable app, lovable security, lovable supabase rls, lovable cloud, lovable production, ai app rescue, vibe coded app, supabase row level security",[702,703,704,705,706],"A Lovable app talks to its Supabase database straight from the browser with a public key, so row-level security (RLS) is what stops one user from reading everyone's data.","Lovable's own docs say \"Missing RLS policies are the most common way app data gets exposed,\" and that its scans \"cannot guarantee complete security.\"","The Quick scan runs every time you publish, but the Deep scan, which reviews your app code, does not run automatically.","Reverting in Lovable restores your code, not your database data, so test risky changes before real users depend on them.","Supabase now requires an explicit grant for new tables (in all existing projects from October 30, 2026), and existing tables keep theirs, so old leaks stay open.","https:\u002F\u002Fapp369.com\u002Fblog\u002Flovable-app-rescue-2026\u002F","Qh9ND95m05Zft1xna4NHBqPZ1C0YzR8BJQTWj3Dyxv4",{"id":710,"title":711,"author":712,"body":714,"category":268,"checker":272,"createdAt":1440,"description":1441,"disclosure":272,"extension":273,"faq":1442,"howTo":1458,"lastVerified":272,"location":291,"meta":1472,"navigation":298,"ogImage":272,"path":1478,"primaryKeyword":1479,"readingTime":1480,"related":272,"seo":1481,"sources":1482,"stem":1492,"tags":1493,"takeaways":1494,"updatedAt":1500,"url":1501,"__hash__":1502},"blog\u002Fblog\u002Fsupabase-permission-denied-new-tables-october-30-2026.md","Supabase \"Permission Denied\" on New Tables: the October 30 Fix",{"name":7,"social":713},{"twitter":9},{"type":11,"value":715,"toc":1432},[716,739,745,749,757,816,858,861,897,901,912,975,994,998,1007,1197,1200,1266,1270,1299,1306,1310,1389,1396,1400,1422,1428],[14,717,718,721,722,725,726,64,729,243,732,734,735,738],{},[17,719,720],{},"From October 30, 2026, a table you add to an existing Supabase project is invisible to your app until you grant it."," Supabase used to give every new table in the ",[22,723,724],{},"public"," schema to the ",[22,727,728],{},"anon",[22,730,731],{},"authenticated",[22,733,67],{}," roles automatically. It now leaves that to you. Tables you already have keep working; a table created after the change returns ",[22,736,737],{},"permission denied for table"," until its migration includes the grants.",[14,740,741,742,744],{},"To see which tables in your migrations are affected, paste them into the free ",[222,743,541],{"href":540},". It runs in your browser and never uploads your SQL.",[30,746,748],{"id":747},"what-changes-and-when","What changes, and when",[14,750,751,752,756],{},"Supabase announced the change in its ",[222,753,755],{"href":689,"rel":754},[397],"changelog on April 28, 2026",":",[758,759,760,773],"table",{},[761,762,763],"thead",{},[764,765,766,770],"tr",{},[767,768,769],"th",{},"Date",[767,771,772],{},"What happens",[774,775,776,785,796,804],"tbody",{},[764,777,778,782],{},[779,780,781],"td",{},"April 28, 2026",[779,783,784],{},"New projects can opt out of exposing new tables when they are created",[764,786,787,790],{},[779,788,789],{},"May 18, 2026",[779,791,792,795],{},[22,793,794],{},"pg_graphql"," is no longer enabled by default",[764,797,798,801],{},[779,799,800],{},"May 30, 2026",[779,802,803],{},"New projects stop exposing new tables by default (rolled out over a few weeks)",[764,805,806,811],{},[779,807,808],{},[17,809,810],{},"October 30, 2026",[779,812,813],{},[17,814,815],{},"The same default applies to all existing projects",[14,817,818,819,823,824,826,827,830,831,64,833,243,835,837,838,841,842,845,846,849,850,853,854,857],{},"What changes is Postgres's ",[820,821,822],"em",{},"default privileges"," in the ",[22,825,724],{}," schema. Before, every new table was granted ",[22,828,829],{},"select, insert, update, delete"," to ",[22,832,728],{},[22,834,731],{},[22,836,67],{},", and new sequences got ",[22,839,840],{},"usage, select",". The hosted change removes those two defaults, and Supabase's setting is worded as \"Automatically expose new tables and functions\". Supabase's Securing your API guide says that on existing projects new functions receive ",[22,843,844],{},"EXECUTE"," by default, and that the platform change revokes these automatic grants, so plan to grant ",[22,847,848],{},"execute"," on any function you call through the Data API. (The local CLI revokes the defaults for new functions as well; see below.) Without those defaults, the Data API (REST at ",[22,851,852],{},"\u002Frest\u002Fv1"," and GraphQL at ",[22,855,856],{},"\u002Fgraphql\u002Fv1",") can't see a new table until a role is granted on it.",[14,859,860],{},"What doesn't change:",[561,862,863,869,875,891],{},[199,864,865,868],{},[17,866,867],{},"Existing tables"," keep the grants they already have.",[199,870,871,874],{},[17,872,873],{},"Row-level security"," works exactly as before.",[199,876,877,880,881,64,884,243,887,890],{},[17,878,879],{},"Other schemas",", such as ",[22,882,883],{},"auth",[22,885,886],{},"storage",[22,888,889],{},"realtime",", aren't affected.",[199,892,893,896],{},[17,894,895],{},"Direct Postgres connections"," (psql, an ORM or your own server) aren't affected. The change matters if your app talks to Supabase through supabase-js, REST or GraphQL.",[30,898,900],{"id":899},"the-symptom","The symptom",[14,902,903,904,908,909,756],{},"A request to a new table without grants fails with Postgres error 42501. This is the response ",[222,905,907],{"href":689,"rel":906},[397],"Supabase's changelog"," shows, with its example table renamed to ",[22,910,911],{},"projects",[913,914,918],"pre",{"className":915,"code":916,"language":917,"meta":255,"style":255},"language-json shiki shiki-themes github-light github-dark","{\n  \"code\": \"42501\",\n  \"message\": \"permission denied for table projects\",\n  \"hint\": \"Grant the required privileges to the current role with: GRANT SELECT ON public.projects TO anon;\"\n}\n","json",[22,919,920,929,945,958,969],{"__ignoreMap":255},[921,922,925],"span",{"class":923,"line":924},"line",1,[921,926,928],{"class":927},"sVt8B","{\n",[921,930,931,935,938,942],{"class":923,"line":256},[921,932,934],{"class":933},"sj4cs","  \"code\"",[921,936,937],{"class":927},": ",[921,939,941],{"class":940},"sZZnC","\"42501\"",[921,943,944],{"class":927},",\n",[921,946,948,951,953,956],{"class":923,"line":947},3,[921,949,950],{"class":933},"  \"message\"",[921,952,937],{"class":927},[921,954,955],{"class":940},"\"permission denied for table projects\"",[921,957,944],{"class":927},[921,959,961,964,966],{"class":923,"line":960},4,[921,962,963],{"class":933},"  \"hint\"",[921,965,937],{"class":927},[921,967,968],{"class":940},"\"Grant the required privileges to the current role with: GRANT SELECT ON public.projects TO anon;\"\n",[921,970,972],{"class":923,"line":971},5,[921,973,974],{"class":927},"}\n",[14,976,977,978,981,982,985,986,989,990,993],{},"In supabase-js, the ",[22,979,980],{},"error"," object comes back filled and ",[22,983,984],{},"data"," is ",[22,987,988],{},"null",". If the app doesn't show errors, users simply see an empty screen or a button that does nothing. The same query works in the SQL editor, which runs as ",[22,991,992],{},"postgres",", the role that owns the table and has every privilege, and fails in the app. That is why this one can be confusing.",[30,995,997],{"id":996},"the-fix-grant-in-the-same-migration","The fix: grant in the same migration",[14,999,1000,1001,1006],{},"Put the grants in the migration that creates the table, so every environment (local, staging, production) ends up the same. This is the pattern from Supabase's ",[222,1002,1005],{"href":1003,"rel":1004},"https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fapi\u002Fsecuring-your-api",[397],"Securing your API"," guide:",[913,1008,1012],{"className":1009,"code":1010,"language":1011,"meta":255,"style":255},"language-sql shiki shiki-themes github-light github-dark","create table public.projects (\n  id uuid primary key default gen_random_uuid(),\n  user_id uuid not null references auth.users on delete cascade,\n  name text not null\n);\n\n-- 1. Who can reach the table at all\ngrant select, insert, update, delete on table public.projects to authenticated;\ngrant select, insert, update, delete on table public.projects to service_role;\n\n-- 2. Which rows they can see and change\nalter table public.projects enable row level security;\n\ncreate policy \"Owners can read their projects\"\n  on public.projects for select\n  to authenticated\n  using ((select auth.uid()) = user_id);\n\ncreate policy \"Owners can add projects\"\n  on public.projects for insert\n  to authenticated\n  with check ((select auth.uid()) = user_id);\n\ncreate policy \"Owners can update their projects\"\n  on public.projects for update\n  to authenticated\n  using ((select auth.uid()) = user_id)\n  with check ((select auth.uid()) = user_id);\n\ncreate policy \"Owners can delete their projects\"\n  on public.projects for delete\n  to authenticated\n  using ((select auth.uid()) = user_id);\n","sql",[22,1013,1014,1019,1024,1029,1034,1039,1045,1051,1057,1063,1068,1074,1080,1085,1091,1097,1103,1109,1114,1120,1126,1131,1137,1142,1148,1154,1159,1165,1170,1175,1181,1187,1192],{"__ignoreMap":255},[921,1015,1016],{"class":923,"line":924},[921,1017,1018],{},"create table public.projects (\n",[921,1020,1021],{"class":923,"line":256},[921,1022,1023],{},"  id uuid primary key default gen_random_uuid(),\n",[921,1025,1026],{"class":923,"line":947},[921,1027,1028],{},"  user_id uuid not null references auth.users on delete cascade,\n",[921,1030,1031],{"class":923,"line":960},[921,1032,1033],{},"  name text not null\n",[921,1035,1036],{"class":923,"line":971},[921,1037,1038],{},");\n",[921,1040,1042],{"class":923,"line":1041},6,[921,1043,1044],{"emptyLinePlaceholder":298},"\n",[921,1046,1048],{"class":923,"line":1047},7,[921,1049,1050],{},"-- 1. Who can reach the table at all\n",[921,1052,1054],{"class":923,"line":1053},8,[921,1055,1056],{},"grant select, insert, update, delete on table public.projects to authenticated;\n",[921,1058,1060],{"class":923,"line":1059},9,[921,1061,1062],{},"grant select, insert, update, delete on table public.projects to service_role;\n",[921,1064,1066],{"class":923,"line":1065},10,[921,1067,1044],{"emptyLinePlaceholder":298},[921,1069,1071],{"class":923,"line":1070},11,[921,1072,1073],{},"-- 2. Which rows they can see and change\n",[921,1075,1077],{"class":923,"line":1076},12,[921,1078,1079],{},"alter table public.projects enable row level security;\n",[921,1081,1083],{"class":923,"line":1082},13,[921,1084,1044],{"emptyLinePlaceholder":298},[921,1086,1088],{"class":923,"line":1087},14,[921,1089,1090],{},"create policy \"Owners can read their projects\"\n",[921,1092,1094],{"class":923,"line":1093},15,[921,1095,1096],{},"  on public.projects for select\n",[921,1098,1100],{"class":923,"line":1099},16,[921,1101,1102],{},"  to authenticated\n",[921,1104,1106],{"class":923,"line":1105},17,[921,1107,1108],{},"  using ((select auth.uid()) = user_id);\n",[921,1110,1112],{"class":923,"line":1111},18,[921,1113,1044],{"emptyLinePlaceholder":298},[921,1115,1117],{"class":923,"line":1116},19,[921,1118,1119],{},"create policy \"Owners can add projects\"\n",[921,1121,1123],{"class":923,"line":1122},20,[921,1124,1125],{},"  on public.projects for insert\n",[921,1127,1129],{"class":923,"line":1128},21,[921,1130,1102],{},[921,1132,1134],{"class":923,"line":1133},22,[921,1135,1136],{},"  with check ((select auth.uid()) = user_id);\n",[921,1138,1140],{"class":923,"line":1139},23,[921,1141,1044],{"emptyLinePlaceholder":298},[921,1143,1145],{"class":923,"line":1144},24,[921,1146,1147],{},"create policy \"Owners can update their projects\"\n",[921,1149,1151],{"class":923,"line":1150},25,[921,1152,1153],{},"  on public.projects for update\n",[921,1155,1157],{"class":923,"line":1156},26,[921,1158,1102],{},[921,1160,1162],{"class":923,"line":1161},27,[921,1163,1164],{},"  using ((select auth.uid()) = user_id)\n",[921,1166,1168],{"class":923,"line":1167},28,[921,1169,1136],{},[921,1171,1173],{"class":923,"line":1172},29,[921,1174,1044],{"emptyLinePlaceholder":298},[921,1176,1178],{"class":923,"line":1177},30,[921,1179,1180],{},"create policy \"Owners can delete their projects\"\n",[921,1182,1184],{"class":923,"line":1183},31,[921,1185,1186],{},"  on public.projects for delete\n",[921,1188,1190],{"class":923,"line":1189},32,[921,1191,1102],{},[921,1193,1195],{"class":923,"line":1194},33,[921,1196,1108],{},[14,1198,1199],{},"A few details are easy to miss:",[561,1201,1202,1215,1234,1257],{},[199,1203,1204,1207,1208,1210,1211,1214],{},[17,1205,1206],{},"Grant only what each role needs."," A table that signed-out visitors should never touch gets no ",[22,1209,728],{}," grant at all. Public read-only data gets ",[22,1212,1213],{},"grant select ... to anon"," and nothing more.",[199,1216,1217,1223,1224,1226,1227,1230,1231,253],{},[17,1218,1219,1222],{},[22,1220,1221],{},"serial"," columns need a sequence grant."," If the table uses ",[22,1225,1221],{}," or ",[22,1228,1229],{},"bigserial"," rather than an identity column or a UUID, inserts also need ",[22,1232,1233],{},"grant usage, select on sequence public.projects_id_seq to authenticated;",[199,1235,1236,1241,1242,1245,1246,1249,1250,1253,1254,1256],{},[17,1237,1238,1239,253],{},"Functions called over the API need ",[22,1240,848],{}," For a function your app calls with ",[22,1243,1244],{},"rpc()",", use ",[22,1247,1248],{},"grant execute on function public.your_function() to authenticated;",". A ",[22,1251,1252],{},"security definer"," function runs with its owner's rights and bypasses RLS, so grant ",[22,1255,848],{}," only to roles that should call it, and review those functions.",[199,1258,1259,1262,1263,1265],{},[17,1260,1261],{},"Grants are not a replacement for RLS."," With a grant and RLS off, any signed-in user, or anyone at all if ",[22,1264,728],{}," is granted, can read every row. Turn RLS on for every exposed table.",[30,1267,1269],{"id":1268},"local-development-already-works-this-way","Local development already works this way",[14,1271,1272,1273,1278,1279,243,1282,1285,1286,1288,1289,484,1292,1295,1296,253],{},"If local tables work but the hosted project doesn't (or the other way round), check your Supabase CLI version. Since ",[222,1274,1277],{"href":1275,"rel":1276},"https:\u002F\u002Fgithub.com\u002Fsupabase\u002Fcli\u002Freleases\u002Ftag\u002Fv2.106.0",[397],"Supabase CLI v2.106.0"," (June 11, 2026), ",[22,1280,1281],{},"supabase start",[22,1283,1284],{},"supabase db reset"," revoke the default Data API privileges for new tables, sequences and functions in ",[22,1287,724],{},", because ",[22,1290,1291],{},"[api].auto_expose_new_tables",[22,1293,1294],{},"config.toml"," now defaults to ",[22,1297,1298],{},"false",[14,1300,1301,1302,1305],{},"So a migration without grants fails locally with the same 42501 error. That's useful: it shows the problem before you deploy. Setting ",[22,1303,1304],{},"auto_expose_new_tables = true"," brings the old behaviour back for now, but the CLI release notes say the flag is deprecated and scheduled for removal on October 30, 2026. Add the grants to the migration instead.",[30,1307,1309],{"id":1308},"check-your-project-before-october-30","Check your project before October 30",[196,1311,1312,1333,1342,1350],{},[199,1313,1314,1317,1318,1321,1322,1325,1326,1328,1329,1332],{},[17,1315,1316],{},"List your newest migrations"," (",[22,1319,1320],{},"supabase\u002Fmigrations\u002F"," in the repo, or the SQL your AI tool generated) and look for ",[22,1323,1324],{},"create table"," statements in ",[22,1327,724],{}," without matching ",[22,1330,1331],{},"grant"," lines.",[199,1334,1335,1341],{},[17,1336,1337,1338,253],{},"Run them through the ",[222,1339,1340],{"href":540},"grants checker"," It lists each table that would need a grant, each table with RLS off, and each policy that lets anyone in.",[199,1343,1344,1349],{},[17,1345,1346,1347,253],{},"Test as a real user, not as ",[22,1348,992],{}," Sign in to the app with a normal account and use each feature that touches a new table. The SQL editor bypasses grants, so it won't show the problem.",[199,1351,1352,1355,1356,1360,1361,1385,1388],{},[17,1353,1354],{},"Opt in early if you can."," Supabase lets existing projects switch to the new default before October 30. The ",[222,1357,1359],{"href":689,"rel":1358},[397],"changelog"," gives the SQL to run in the SQL editor; it changes only tables and sequences created afterwards:",[913,1362,1364],{"className":1009,"code":1363,"language":1011,"meta":255,"style":255},"alter default privileges for role postgres in schema public\n  revoke select, insert, update, delete on tables from anon, authenticated, service_role;\nalter default privileges for role postgres in schema public\n  revoke usage, select on sequences from anon, authenticated, service_role;\n",[22,1365,1366,1371,1376,1380],{"__ignoreMap":255},[921,1367,1368],{"class":923,"line":924},[921,1369,1370],{},"alter default privileges for role postgres in schema public\n",[921,1372,1373],{"class":923,"line":256},[921,1374,1375],{},"  revoke select, insert, update, delete on tables from anon, authenticated, service_role;\n",[921,1377,1378],{"class":923,"line":947},[921,1379,1370],{},[921,1381,1382],{"class":923,"line":960},[921,1383,1384],{},"  revoke usage, select on sequences from anon, authenticated, service_role;\n",[1386,1387],"br",{},"Doing it on a staging project first shows you any missing grants on your schedule instead of the deadline's.",[14,1390,1391,1392,253],{},"For every other dated Apple, Google Play and Firebase requirement in 2026 and 2027, see ",[222,1393,1395],{"href":1394},"\u002Fblog\u002Fapp-store-google-play-deadlines-2026-2027\u002F","App Store and Google Play deadlines for 2026 and 2027",[30,1397,1399],{"id":1398},"if-you-use-lovable-bolt-or-another-ai-builder","If you use Lovable, Bolt or another AI builder",[14,1401,1402,1403,484,1405,1407,1408,1410,1411,1414,1415,1418,1419,253],{},"These tools write SQL migrations for you, and nothing in a generated migration warns you that the defaults changed. Read each new migration before you approve it: every ",[22,1404,1324],{},[22,1406,724],{}," should be followed by a ",[22,1409,1331],{}," for each role that needs it and by ",[22,1412,1413],{},"enable row level security",". If you can't read the SQL yourself, paste it into the checker; it flags missing grants in plain language. On Lovable, the grants are one of ",[222,1416,1417],{"href":229},"seven problems to check before launch",", and Bolt has ",[222,1420,1421],{"href":616},"its own pre-launch checklist",[14,1423,1424,1425,1427],{},"If your AI-built app has more than a couple of these problems, or users are already seeing empty screens, App369's ",[222,1426,225],{"href":224}," starts with a $450 Launch Check. Within 3 business days of read-only access, you get each issue it finds in sign-in, data access, payments and deploys, ranked, with where it is, plus a fixed price to fix the worst of them. The $450 is credited to that fix.",[1429,1430,1431],"style",{},"html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":255,"searchDepth":256,"depth":256,"links":1433},[1434,1435,1436,1437,1438,1439],{"id":747,"depth":256,"text":748},{"id":899,"depth":256,"text":900},{"id":996,"depth":256,"text":997},{"id":1268,"depth":256,"text":1269},{"id":1308,"depth":256,"text":1309},{"id":1398,"depth":256,"text":1399},"2026-10-15T18:00:00.000Z","From October 30, 2026, new Supabase tables return \"permission denied for table\" (42501) until you grant them. What changes, who is affected, and the exact SQL to fix it.",[1443,1446,1449,1452,1455],{"question":1444,"answer":1445},"Why does Supabase say \"permission denied for table\" on a table I just created?","Since the Data API change (May 30, 2026 for new projects, October 30, 2026 for existing ones), new tables in the public schema have no grants for anon, authenticated or service_role. Add the grants in the migration that creates the table.",{"question":1447,"answer":1448},"Will my existing Supabase tables stop working on October 30?","No. Supabase says existing tables keep their current grants. Only tables created after the change need explicit grants.",{"question":1450,"answer":1451},"Is this the same as a row-level security error?","No. A missing grant fails every request with \"permission denied for table\". RLS blocks differently: reads return no rows, updates and deletes on hidden rows change nothing, and a blocked insert fails with \"new row violates row-level security policy\".",{"question":1453,"answer":1454},"Can I turn the change off for an existing project?","Supabase documents a rollback that restores the old default privileges, but that exposes every future table again. Granting each table on purpose is safer.",{"question":1456,"answer":1457},"Does this affect Lovable, Bolt or other AI-built apps?","It affects any project that reaches new tables through the Data API (supabase-js, REST or GraphQL), whoever wrote the migrations, which covers most AI-built apps. Apps that only use a direct Postgres connection are not affected. Check new migrations for a grant per role before they run.",{"name":1459,"steps":1460},"Check your Supabase project before October 30",[1461,1463,1466,1469],{"name":1316,"text":1462},"List your newest migrations and look for create table statements in public without matching grant lines.",{"name":1464,"text":1465},"Run them through the grants checker","It lists each table that would need a grant, each table with RLS off, and each policy that lets anyone in.",{"name":1467,"text":1468},"Test as a real user, not as postgres","Sign in to the app with a normal account and use each feature that touches a new table. The SQL editor bypasses grants, so it won't show the problem.",{"name":1470,"text":1471},"Opt in early if you can","Supabase lets existing projects switch to the new default before October 30.",{"readingTimeStats":1473},{"text":1474,"minutes":1475,"time":1476,"words":1477},"6 min read",6.005,360300,1201,"\u002Fblog\u002Fsupabase-permission-denied-new-tables-october-30-2026","supabase permission denied for table","7 min",{"title":711,"description":1441},[1483,1485,1487,1489],{"title":1484,"url":1275},"Supabase CLI v2.106.0 release notes (June 11, 2026)",{"title":1486,"url":689},"Supabase changelog: tables not exposed to Data and GraphQL API automatically (April 28, 2026)",{"title":1488,"url":1003},"Supabase docs: Securing your API",{"title":1490,"url":1491},"PostgreSQL docs: GRANT","https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fsql-grant.html","blog\u002Fsupabase-permission-denied-new-tables-october-30-2026","supabase permission denied, supabase 42501, supabase grants, supabase data api, supabase october 30, supabase new tables, lovable supabase, row level security",[1495,1496,1497,1498,1499],"On October 30, 2026, Supabase stops granting new tables in the public schema to anon, authenticated and service_role in existing projects. New projects have worked this way since May 30.","Tables you already have keep their grants and keep working. Only tables created after the change are affected.","A new table without grants fails with error 42501, \"permission denied for table\", in supabase-js, the REST API and GraphQL.","The fix is one grant per role in the same migration that creates the table, next to row-level security and its policies.","Grants decide whether a role can reach a table at all; RLS policies decide which rows it sees. You need both.","2026-10-19T23:50:00.000Z","https:\u002F\u002Fapp369.com\u002Fblog\u002Fsupabase-permission-denied-new-tables-october-30-2026\u002F","xqTfOTDFTyma2FYucqhgtCWL01vHENNqh4Amk3f4ZHI",[1504,1506,1507,1510,1513,1516],{"keyword":5,"url":360,"title":5,"relevance":1505},67,{"keyword":365,"url":707,"title":365,"relevance":1194},{"keyword":1508,"url":1509,"title":1508,"relevance":1183},"Cursor App Rescue: 7 Problems to Fix Before Launch","https:\u002F\u002Fapp369.com\u002Fblog\u002Fcursor-app-rescue-2026\u002F",{"keyword":1511,"url":1512,"title":1511,"relevance":1156},"Base44 App Rescue: 8 Problems to Fix Before Launch","https:\u002F\u002Fapp369.com\u002Fblog\u002Fbase44-app-rescue-2026\u002F",{"keyword":1514,"url":1515,"title":1514,"relevance":1150},"Replit App Rescue: 7 Problems to Fix Before Launch","https:\u002F\u002Fapp369.com\u002Fblog\u002Freplit-app-rescue-2026\u002F",{"keyword":1517,"url":1518,"title":1517,"relevance":1144},"v0 App Rescue: 8 Problems to Fix Before Launch","https:\u002F\u002Fapp369.com\u002Fblog\u002Fv0-app-rescue-2026\u002F",1792486032216]