DEV Community: WaterShow

Why Google and ChatGPT can't see your Lovable app (and how to fix it)

WaterShow — Mon, 26 Oct 2026 20:59:22 +0000

You built the app in Lovable, Bolt or v0, it works, people like it. Then you search for it on Google and get nothing useful, and when you ask ChatGPT about your product it has never heard of it.

Most of the time the app is fine. The problem is what search engines and AI assistants receive when they open your link.

What a crawler actually downloads

Apps from AI builders are usually single-page React apps. When anyone opens the link, the server sends a tiny HTML file that looks roughly like this:

<body>
  <div id="root"></div>
  <script type="module" src="/assets/index-a1b2c3.js"></script>
</body>

Your headings, prices, features and contact details are not in that file. They appear only after the browser downloads and runs the JavaScript. People never notice, because their browser does it in a second.

Who runs JavaScript and who doesn't

Google can run JavaScript, but it does it in a second pass that can come days later, and pages with heavy scripts sometimes get indexed with missing text or not at all.

AI assistants are worse off. The crawlers behind ChatGPT, Claude and Perplexity mostly read the HTML and do not run JavaScript. In Vercel's analysis of AI crawler traffic, none of the major AI crawlers rendered JavaScript. For them your app is an empty div.

So the same page that looks great to a visitor can be invisible to the tools people now use to find products.

Check your app in 30 seconds

The quickest way: paste your link into the free visibility check. It shows how many words of your content are in the HTML, plus the title, description, link preview, sitemap, robots.txt, llms.txt and mobile speed, each with what to fix.

If you prefer to do it by hand, open your site and press Ctrl+U (or Cmd+Option+U on a Mac) to view the page source. Search for a sentence that is visible on the page. If you cannot find it in the source, crawlers cannot find it either.

Five fixes, from easiest to most thorough

1. Put the basics in index.html. Even a single-page app has one real HTML file. Give it a proper <title>, a meta description, Open Graph tags for link previews and a canonical link. In Lovable you can ask it to edit index.html, or change it in the code on GitHub. This alone fixes how your link looks in search results and chats.

2. Add robots.txt, sitemap.xml and llms.txt. Put them in the public folder so they are served from the root of your domain. The sitemap lists your pages, robots.txt points crawlers to it, and llms.txt is a short plain-text summary of what your site offers, written for AI assistants.

3. Add structured data. A small JSON-LD block in index.html that says who you are, what you sell and where you are. Google and AI assistants use it to describe your business without guessing.

4. Prerender your public pages. This is the fix that actually puts your text into the HTML. A prerender step runs your app at build time and saves the finished HTML for each public route (home, pricing, features, blog). Visitors still get the full app, but crawlers receive real content. For a Vite app like the ones Lovable and Bolt generate, this is usually a plugin plus a list of routes to render.

5. Move the marketing pages to a framework that renders on the server. If content and search traffic matter a lot, keep the logged-in app where it is and build the public pages with Next.js or Astro, which send full HTML by default. It is more work, but it is the most robust option.

For most apps, steps 1 to 4 are enough and take a day or two.

What I usually find

When I check apps built with AI tools, the pattern is almost always the same: a generic title like "Vite + React", no description, no link preview image, no sitemap, and fewer than twenty words of real content in the HTML. Each piece is small, but together they make the product invisible outside of direct links.

If you want it done for you, I fix exactly this: prerendering, meta tags, link previews, sitemap, robots.txt, structured data and llms.txt, with a fixed quote first. Run the free check and send me the report.

FAQ

Can Google index a Lovable app at all?

Yes, but slowly and not always completely. Google renders JavaScript in a second pass, so pages can sit unindexed for days or get indexed with missing text. Putting real text into the HTML with prerendering removes the guesswork.

Why does ChatGPT not know about my product?

The crawlers that feed ChatGPT, Claude and Perplexity mostly read only the HTML and do not run JavaScript. If your content appears only after scripts run, they see an empty page and have nothing to quote.

Do I need to rebuild my app to fix this?

Usually not. Fixing index.html, adding a sitemap, robots.txt, llms.txt and structured data, and prerendering the public pages keeps your app as it is. Moving marketing pages to Next.js or Astro is only worth it when search traffic really matters.

Originally published at watershowdigital.com/blog/why-chatgpt-cant-see-your-lovable-app. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

How to get Reddit data in 2026 now that the API is closed

WaterShow — Mon, 26 Oct 2026 02:07:47 +0000

If you tried to create a Reddit app recently, you hit a wall. Since November 2025 Reddit no longer hands out API keys on request: every new app needs manual approval under the Responsible Builder Policy, and personal or small commercial projects are often turned down or never hear back. Even automation tools like Make and Pipedream now ask you for your own approved Reddit app before they connect.

So what do you do if you just need posts and comments for research, lead generation or monitoring? Here are the options that still work, from simplest to most capable.

1. RSS feeds, for light monitoring

Almost every Reddit listing has an RSS version. Add .rss to the URL:

https://www.reddit.com/r/SaaS/new/.rss
https://www.reddit.com/search.rss?q=looking+for+a+crm&sort=new
https://www.reddit.com/r/SaaS/comments/abc123/.rss

You get titles, full post text, authors and dates, up to 100 items per request. Good enough to watch a few subreddits or keywords.

The limits: no scores, no comment counts, and Reddit rate limits RSS hard. If you poll more than a few times a minute from one IP you start getting 429 Too Many Requests. Combine several subreddits into one feed (/r/a+b+c/new/.rss) to make fewer requests.

2. Apply for API access anyway

If you need to post or vote, the API is the only legitimate way, so it is worth applying. Use the support request form on reddithelp.com, describe one concrete use case, the volume, and how you handle data. Be honest about commercial use. Expect anything from a week to no answer at all, so do not build a business that depends on it.

3. A scraper that reads public pages

For anything bigger than a few feeds, you want a tool that reads Reddit's public pages for you, handles rate limits and gives you clean data. I built Reddit Scraper & AI Lead Finder for this. It needs no API key and no Reddit login:

search posts by keyword, sitewide or inside subreddits
pull new, hot, top or rising posts from any subreddit
get posts from a user profile, or comments from a post URL
scores, comment counts, upvote ratio and full text, ready for CSV or JSON

{
  "searchQueries": ["looking for a crm", "alternative to hubspot"],
  "subreddits": ["SaaS", "startups"],
  "sort": "new",
  "timeRange": "week",
  "maxPostsPerSource": 100
}

It costs $1 per 1,000 posts. If you add a short description of what you sell, its optional AI mode scores each post for buying intent and drafts a reply, which turns it into a lead finder rather than a plain scraper.

Which one to pick

Watching a few keywords for yourself: RSS feeds and a small script.
Research, dashboards, lead lists, anything over a few hundred posts a day: a managed scraper.
Posting, voting or messaging: only the official API. Do not automate those any other way, Reddit bans accounts for it.

Play fair

Whatever you use, stick to public data, keep request rates reasonable, and do not collect personal information you do not need. Reddit is a community first. Tools that read it to find people who need help are fine. Tools that spam it get everyone blocked.

FAQ

How can I read Reddit posts without an API key?

You can use RSS feeds for light monitoring by adding .rss to Reddit URLs. For pulling larger amounts of data for research or dashboards, you can use a managed scraper. Scrapers read public pages without needing an API key or a Reddit login.

What data is included in a Reddit RSS feed?

A Reddit RSS feed provides the titles, full post text, authors and dates for up to 100 items. It does not include post scores or comment counts. You also have to be careful with rate limits to avoid getting error messages.

Can I still automate posting and voting on Reddit?

Only through the official API. Since November 2025 every new Reddit app needs manual approval under the Responsible Builder Policy, and small projects are often turned down. Automating posting or voting any other way gets accounts banned.

Originally published at watershowdigital.com/blog/reddit-data-without-api-2026. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

Lovable app works in preview but breaks after deploy? Seven fixes

WaterShow — Mon, 26 Oct 2026 02:07:46 +0000

Everything works in the Lovable preview. You deploy it to your own domain on Vercel or Netlify, and suddenly login loops, pages go blank or the data never shows up.

The app is almost never "broken". Something that the preview handled for you is missing in production. Here are the seven causes I see most often, in the order I check them.

1. Supabase still redirects to localhost or the preview URL

Symptom: you log in, and you land on localhost:3000 or the old preview link, or you end up back on the login page.

Fix: in Supabase go to Authentication → URL Configuration.

Site URL: your real domain, for example https://myapp.com
Redirect URLs: add https://myapp.com/** (and your Vercel preview domain if you use it)

If you use Google or GitHub login, the provider's own console needs the Supabase callback URL too: https://<project>.supabase.co/auth/v1/callback.

2. Environment variables are missing on the host

Symptom: blank page, or errors like supabaseUrl is required in the browser console.

Lovable keeps your keys in the project. Vercel and Netlify do not know them. Add them in the host's settings:

VITE_SUPABASE_URL=https://xxxx.supabase.co
VITE_SUPABASE_PUBLISHABLE_KEY=...

Then redeploy. Variables are baked in at build time, so changing them without a new build does nothing.

3. Refreshing a page gives a 404

Symptom: the home page works, but refreshing /dashboard or opening it from a link shows "404 Not Found".

Lovable apps are single page apps: there is only one real index.html. Tell the host to send every route to it.

Vercel, vercel.json in the project root:

{ "rewrites": [{ "source": "/(.*)", "destination": "/index.html" }] }

Netlify, a file public/_redirects:

/*  /index.html  200

4. RLS blocks the data in production

Symptom: the page loads but lists are empty, or saving fails with new row violates row-level security policy.

In the preview you might have been testing as a different user, or with policies that changed since. Check that every table your app reads has a select policy for logged in users and every table it writes has a matching insert or update policy. I wrote a separate guide on the six causes of RLS insert errors.

5. The service role key ended up in the frontend

Symptom: everything works, which is the dangerous part.

If your code creates the Supabase client with the service_role key, anyone can open the network tab, copy it and read or delete your whole database. Search your code for service_role. In the browser only the publishable (anon) key belongs. Anything that needs full access moves to an Edge Function.

6. Stripe works in test mode only

Symptom: checkout opens, payment succeeds, but the user never gets access.

Usually the webhook is still pointing at the test endpoint or uses the test signing secret. In Stripe switch to live mode, create the webhook for your production URL, and put the live STRIPE_WEBHOOK_SECRET into your function's secrets.

7. Emails go nowhere

Symptom: sign up works but the confirmation email never arrives.

Supabase's built in email is rate limited and meant for testing. For real users, connect your own SMTP (Resend, Postmark, SendGrid) under Authentication → SMTP Settings, and add the DNS records your provider asks for so emails do not land in spam.

Still stuck?

Open the browser console (F12) and the network tab, reproduce the problem and read the first red error. Nine times out of ten it names the cause. If it does not, or you would rather not spend the weekend on it, this is the kind of fix I do: fixed price up front, usually done in 48 hours.

FAQ

Why do I get a 404 error when I refresh my Lovable app?

This happens because Lovable apps are single page apps with only one real index.html file. To fix it, you need to tell your host to send every route to that file. You do this using a vercel.json file for Vercel or a public/_redirects file for Netlify.

Why is my Supabase data not loading after I deploy?

Your environment variables might be missing from your Vercel or Netlify settings. If you add them, you must redeploy your app since variables are baked in at build time. It is also possible that your row-level security policies are blocking the data.

Why am I redirected to localhost after logging in?

This occurs when Supabase still redirects to your old preview link or localhost. Go to the URL Configuration under Authentication in Supabase to fix this. Update your Site URL to your real domain and add it to your Redirect URLs.

Originally published at watershowdigital.com/blog/lovable-app-breaks-after-deploy. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

How to see every Google ad your competitor runs (and what to steal from them)

WaterShow — Mon, 26 Oct 2026 02:02:33 +0000

Your competitor has been testing ads for months and paying for every lesson. You can see the results for free, because Google publishes every ad in the Ads Transparency Center: Search, YouTube and Display, with the dates each ad ran and the countries it was shown in.

Most people never open it. Here is how to use it properly.

The manual way, for one competitor

Open adstransparency.google.com.
Type the competitor's domain, for example notion.com, and pick the advertiser from the list. Big companies often have several verified advertiser accounts, one per country or product.
Pick a country in the top bar. Without it you see ads from everywhere.
Switch the format filter between text, image and video.
Click an ad to see its versions, the countries it ran in and, for the EU, roughly how many times it was shown.

This works fine for a quick look at one brand. It gets painful when you want 300 ads from five competitors in a spreadsheet, with the ad text you can actually search and sort.

The fast way: pull everything into a table

I built a small tool for this: Google Ads Spy on Apify. You give it domains or advertiser names, it returns one row per ad:

headline, description and call to action
landing page URL (where the ad actually sends people)
the YouTube link for video ads
first and last date shown, and how many days the ad ran
countries, and impressions where Google publishes them

{
  "domains": ["notion.com", "clickup.com", "monday.com"],
  "region": "US",
  "format": "video",
  "maxAdsPerSource": 100
}

It costs $1.50 per 1,000 ads with full details, so a full teardown of three competitors is well under a dollar. If you also have a Meta Ad Library API token, the same run pulls their Facebook and Instagram ads.

What to look for once you have the list

1. The ads that never stop

Sort by how long each ad has been running. An ad that has run for 120 days is almost certainly profitable, nobody keeps paying for a loser that long. Those are the messages to study first.

2. The landing pages

Group ads by landing page URL. You will usually find two or three pages that get most of the ads. That tells you which offer converts for them: a free trial, a demo, a template gallery, a comparison page against you.

3. The angle, not the wording

Do not copy the headline. Write down the angle behind it: speed ("set up in 5 minutes"), price ("free for teams under 10"), pain ("stop chasing invoices"), social proof ("used by 50,000 teams"). Then test the same angle in your own words.

4. Where they spend

The country list shows where they are pushing. If a competitor suddenly starts running ads in Germany, they are probably launching there. If they stopped in a market, it probably did not pay off.

5. Video hooks

For YouTube ads, watch only the first five seconds of each. That is the hook they paid to test. Collect the ones that keep running and you have a swipe file of hooks that work in your niche.

A simple weekly routine

Run the same input once a week with "only running ads" turned on and save the results. Compare with last week:

new ads mean they are testing something
ads that disappeared were probably losing
a new landing page means a new offer

Twenty minutes a week and you always know what your competitors are betting on, without paying for their mistakes.

Good to know

Search ads are published as an image of the ad, so for those you get a screenshot rather than separate text fields.
Impression numbers are only published for ads shown in the EU.
This is public data Google shows on purpose, so anyone can check who advertises what. Use it to learn, not to clone someone's brand.

FAQ

How much does it cost to download competitor Google ads?

Using the Google Ads Spy tool on Apify costs $1.50 per 1,000 ads to pull the data into a table. Viewing the ads manually in the Google Ads Transparency Center is completely free.

Can you see how many impressions a competitor ad gets?

Google only publishes impression numbers for ads shown in the European Union. For ads shown in other regions, you can see the active dates and countries but not the impression counts.

How do you know if a competitor Google ad is profitable?

You should look at how long the ad has been running. If an ad stays active for a long time, it is almost certainly profitable because advertisers do not keep paying for losing ads.

Originally published at watershowdigital.com/blog/see-competitor-google-ads. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

How to find Substack newsletters to sponsor (with real subscriber counts)

WaterShow — Mon, 26 Oct 2026 02:02:32 +0000

Newsletter sponsorships are one of the few ad channels where people still read the ad. The catch is finding the right newsletters: ones your customers actually read, that are still active, and that are big enough to matter but small enough to afford.

Substack hosts thousands of them. Here is how to build a shortlist.

What makes a newsletter worth sponsoring

Before you search, decide what "good" means for you:

Fit. The topic matches your customer, not just your industry. A newsletter about "AI tools for lawyers" beats a general AI one if you sell to law firms.
Size. Subscribers between 2,000 and 50,000 are usually the sweet spot for small budgets. Big names are expensive and often sold out.
Activity. It posts every week or two. A newsletter that last posted three months ago is dead, whatever its subscriber count says.
A paid tier. Writers with paying readers usually have a more engaged audience.
A real person you can reach. You need an email, X or LinkedIn to pitch them.

The manual way

Go to substack.com and search your topic.
Open each newsletter, note the subscriber count if it is shown, and check the date of the last post.
Look at the "About" page and the author profile for contact links.
Put everything in a spreadsheet.

It works, but it is slow: 10 to 15 minutes per newsletter, and many hide the subscriber count on their own page.

The fast way

I built Substack Newsletter Finder for exactly this. You give it keywords or categories and it returns a table:

newsletter name and URL
subscriber count and the author's follower count
the author's X, LinkedIn, YouTube and website links
last post date and how many posts in the last 30 days
language and whether it has a paid plan

{
  "searchQueries": ["b2b saas", "startup marketing"],
  "minSubscribers": 2000,
  "activeWithinDays": 30,
  "language": "en",
  "maxResults": 200
}

200 newsletters cost about $0.50. Filter by subscribers and activity, sort, and you have a shortlist in a few minutes.

How to pitch

Keep the first email short and specific:

one line on why their audience fits ("your readers are early stage founders, we make invoicing for them")
what you want: one sponsored slot in an upcoming issue
ask for their rate, or offer one if they do not have a media kit

Start with three to five newsletters, not fifty. Run one slot each, track signups with a separate link or code per newsletter, and only rebook the ones that paid back.

Read before you buy

Before paying, read the last five issues. Check that the writing is good, that ads are clearly marked and not stuffed in, and that readers reply or comment. Ten minutes of reading saves you from buying space in a newsletter nobody opens.

A shortcut for writers too

If you run a newsletter yourself, the same list works in reverse: find newsletters of a similar size in your niche and propose a cross promotion. Both of you grow, nobody pays.

FAQ

How do I find the subscriber count for a Substack newsletter?

You can look for the subscriber count manually by opening each newsletter on Substack, though many writers hide this number. Alternatively, you can use the Substack Newsletter Finder tool to automatically pull subscriber counts for a list of newsletters.

What is a good subscriber size for a newsletter sponsorship?

Subscribers between 2,000 and 50,000 are usually the best option for small budgets. Larger newsletters are often expensive and sold out.

How do I pitch a sponsorship to a Substack writer?

Keep your first email short and explain why their audience fits your product. Tell them you want one sponsored slot in an upcoming issue. You should also ask for their rate or offer a price if they lack a media kit.

Originally published at watershowdigital.com/blog/find-substack-newsletters-to-sponsor. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

How to find customers on Reddit without spamming (or getting banned)

WaterShow — Mon, 26 Oct 2026 01:57:10 +0000

Every day somebody on Reddit writes "can anyone recommend a tool for..." or "I'm stuck with this, willing to pay someone to fix it". If you sell that thing, this is the warmest lead you will ever get: they asked first.

The problem is finding those posts before 40 other people answer, and replying without looking like a spammer. Here is the approach that works for me.

Step 1: know what a buying post looks like

Most posts in your niche are not leads. Discussions, launches and memes are noise. Buying intent sounds like this:

"looking for a tool / app / service that..."
"any alternative to X?" (they are unhappy with a competitor)
"willing to pay", "budget is", "hiring", "need someone to"
"how do I fix..." followed by a very concrete broken thing
"we tried X and it didn't work"

Write down 10 to 20 phrases like these for your product. They become your search queries.

Step 2: search the right places

Reddit search is decent if you sort by new. Try queries like:

"alternative to hubspot"
"looking for a crm"
"need help with supabase"

Then list the subreddits where your customers hang out. Not the big general ones: the small, specific ones where people describe their actual problems. For a dev service that might be r/Supabase, r/nextjs, r/SaaS, r/indiehackers, r/forhire.

Checking all of that by hand every day takes an hour. I built Reddit Scraper & AI Lead Finder to do it: you give it search queries, subreddits and a short description of what you sell, and it returns the posts with an intent score, the pain point and a draft reply. You can schedule it every few hours and only look at posts that scored 7 or higher.

Step 3: answer like a person, not a brand

This is where most people burn their account. Rules I follow:

Help first. Give one concrete, useful tip for their exact problem. If your reply is useful without your product, you are doing it right.
Keep it short. Two or three sentences. Nobody reads a wall of text from a stranger.
No links in the first reply. Links from new accounts get filtered or downvoted.
One soft offer at the end. Something like "I can help you set this up if you want, just message me." That is it.
Sound like yourself. No "Great question!", no bullet points, no corporate tone.

A good reply looks like this:

sounds like your redirect URL in Supabase auth still points to localhost, check Authentication then URL configuration. i fix this kind of thing for people, message me if you want a hand

Step 4: move to DMs, then close

When someone replies "yes please" or sends a DM, the hard part is over. Ask one or two questions about their setup, give a fixed price, and offer to start today. Speed wins here: the person who answers within an hour usually gets the job.

How not to get banned

Read each subreddit's rules. Some ban any self-promotion, respect that.
Do not post the same reply twice. Reddit spots copy-paste fast.
Keep the ratio healthy: most of your comments should be plain help with no offer at all.
A few good replies a day beat fifty lazy ones.

What to expect

Most replies go nowhere, and that is fine. You are playing a numbers game with very warm leads: a handful of helpful replies a day, a few conversations a week, and every now and then someone who says "can you just do it for me". It costs half an hour a day, and the people you talk to came asking for help.

FAQ

How do I find people who want to buy on Reddit?

You should look for posts where people specifically ask for tools, alternatives, or help fixing a concrete problem. Search for these buying phrases in small, specific subreddits where your customers actually hang out. You can check these manually or use a tool like Reddit Scraper & AI Lead Finder to automate the search.

Should I put links in my Reddit comments?

Do not include links in your first reply to a user. Links from new accounts often get filtered out or downvoted. Instead, offer a helpful tip and tell the person to message you directly if they want more help.

How can I avoid getting banned when selling on Reddit?

Read the rules of each subreddit and respect any bans on self-promotion. Make sure most of your comments just offer help without pitching your product at all. Never copy and paste the same reply twice because Reddit spots this very quickly.

Originally published at watershowdigital.com/blog/find-customers-on-reddit. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

Supabase RLS blocks your inserts? Six causes and how to fix each

WaterShow — Mon, 26 Oct 2026 01:57:09 +0000

You turned on Row Level Security, wrote a policy that looks right, and now every insert from your app fails with:

new row violates row-level security policy for table "todos"

The good news: this error almost always comes from one of six causes. Go through them in order and you will find yours in a few minutes.

1. There is no INSERT policy at all

When RLS is on, everything is denied until a policy allows it. A lot of apps have a policy for SELECT (often copied from a tutorial) but nothing for INSERT.

Check what you have:

select policyname, cmd, roles, qual, with_check
from pg_policies
where tablename = 'todos';

If there is no row with cmd = 'INSERT' (or ALL), add one:

create policy "users insert own rows"
on public.todos for insert
to authenticated
with check (auth.uid() = user_id);

2. The policy uses USING instead of WITH CHECK

For inserts, Postgres only looks at with check. A using clause is for rows that already exist (select, update, delete). If you wrote the insert rule into using, Postgres either rejects the policy or the insert still fails.

Rule of thumb:

select / delete: using (...)
insert: with check (...)
update: both, using for which rows you may touch, with check for what they may become

3. user_id is empty, so the check can never pass

Your policy says auth.uid() = user_id, but the client sends the row without user_id. Null is not equal to anything, so the check fails.

Either send it from the client, or better, let the database fill it in:

alter table public.todos
alter column user_id set default auth.uid();

Now the client can insert { title: "Buy milk" } and the row is still owned by the right user.

4. The request is not actually logged in

auth.uid() returns null when the request comes in as anon. This happens more often than you would think:

the user's session expired and the client did not refresh it
you call Supabase from a server route or an edge function with the anon key, but never pass the user's access token
the policy says to authenticated, while the request arrives as anon

On the server, create the client with the user's token, so Postgres knows who is asking:

const supabase = createClient(url, anonKey, {
  global: { headers: { Authorization: `Bearer ${accessToken}` } }
})

5. insert().select() also needs a SELECT policy

This one catches almost everybody. If you write:

const { data, error } = await supabase.from('todos').insert({ title }).select()

Supabase inserts the row and then reads it back. Reading it back is a select, so you also need a select policy for that row. Without it the whole call fails with the same RLS error, even though your insert policy is fine.

Either add the select policy:

create policy "users read own rows"
on public.todos for select
to authenticated
using (auth.uid() = user_id);

or drop the .select() if you do not need the row back.

6. A related table has its own rules

If your insert fires a trigger that writes into another table, or the policy itself runs a subquery on another table (for example "is this user a member of this team?"), those tables have RLS too. The check fails because the subquery returns nothing for this user.

Two ways out: give the user read access to the rows the check needs, or move the check into a security definer function that runs with the owner's rights. Keep that function small and only return what the check needs.

How to test a policy without guessing

The SQL editor in the dashboard runs as a superuser, which skips RLS. So a query that works there tells you nothing. Pretend to be the user instead:

begin;
set local role authenticated;
set local request.jwt.claims = '{"sub": "PASTE-A-REAL-USER-ID"}';

insert into public.todos (title) values ('test');

rollback;

If this fails, the problem is in your policies. If it works, the problem is in how your app sends the request (causes 4 and 5).

What not to do

Do not "fix" it by turning RLS off, and do not put the service_role key in the browser. Both make the error go away by giving everyone access to every row. The first person who opens the network tab gets your whole database.

FAQ

Why does Supabase insert().select() fail with an RLS error?

When you add the select method to an insert command, Supabase tries to read the row back after creating it. This means you need a select policy in addition to your insert policy. If you do not have a select policy, the entire call fails.

How do I test Supabase RLS policies in the SQL editor?

The SQL editor runs as a superuser and naturally skips RLS rules. To test a policy correctly, you need to write a transaction that sets the local role to authenticated and provides a real user ID. If the query works this way, your policies are fine and the problem is in your app code.

Should I use using or with check for an insert policy?

You must use with check for insert policies. Postgres only looks at the using clause for rows that already exist, such as when you select or delete data. If you write your insert rule with using, Postgres will reject it and the insert will fail.

Originally published at watershowdigital.com/blog/supabase-rls-blocks-inserts. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.