What is Database?

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Where Database goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Data you can lose · 5 minutes · Free
The agent that reset production
You asked your coding agent to fix a failing migration. It says it 'reset the database to resolve drift'. Your live customers are gone.
How do I stop an AI agent deleting my database?
Do not keep production database credentials where the agent runs. Use a separate development database locally, give production a role that cannot drop tables, and keep backups the agent cannot reach. Instructions like 'never touch production' are not enough; only permissions reliably stop a destructive command.
Walk it, free
Launch day · 4 minutes · Pro
Every page spins forever
Your post goes viral. Within minutes every page spins, then fails. Your database dashboard says CPU is nearly idle.
Why does my app hang with too many connections?
Each copy of a serverless function opens its own database connections, and a traffic spike runs many copies at once, so the database hits its connection limit and refuses new ones. Connect through your database's connection pooler, which shares a few connections across many requests.
Read the fix
Data you can lose · 4 minutes · Pro
Back to yesterday's version
Today's update broke checkout, so you restore yesterday's version in your builder. Now the whole app crashes.
Why does rolling back my app break it?
Rolling back restores your code, not your database. If today's migration renamed or dropped a column, yesterday's code still expects the old shape and crashes. Make schema changes additive: add the new column, switch the code, and remove the old one only when nothing uses it.
Read the fix
Teams and sharing · 4 minutes · Free
Removed, but still inside
You removed a contractor from your team at 2:00pm. At 2:40pm they downloaded the customer list.
Why can a removed user still access data?
If your security rules read the user's role from their sign-in token (JWT claims), the old role stays valid until that token expires, an hour by default in Supabase. Signing them out doesn't revoke a token already issued. Check team membership in the database inside your RLS policies, so every request sees the current team list.
Walk it, free
Data you can lose · 4 minutes · Pro
Exactly 1,000 orders
Your admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.
Why does my Supabase query return only 1000 rows?
Supabase's API returns at most 1,000 rows per request by default, and it does not raise an error when it stops. Ask the database to count instead of downloading rows, and when you need every row, paginate with a stable order such as created_at then id.
Read the fix
Don't trust the browser · 4 minutes · Pro
One coupon, fifty orders
You posted a single-use 100%-off code for a launch giveaway. Within one second it was used for fifty free orders.
Why was a single-use coupon used many times?
Because the code checks whether the coupon was used and marks it used in two separate steps. When many requests arrive at once, they all pass the check before any update happens. Make the database enforce it in one step, for example an update that only succeeds where used is false, or a unique constraint on redemptions.
Read the fix

Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Table, row, column: A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
Authorization: Checking what someone is allowed to do once you know who they are. Signed in does not mean allowed.

All 62 terms in the glossary

Where Database goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Data you can lose · 5 minutes · Free

The agent that reset production

You asked your coding agent to fix a failing migration. It says it 'reset the database to resolve drift'. Your live customers are gone.

How do I stop an AI agent deleting my database?

Do not keep production database credentials where the agent runs. Use a separate development database locally, give production a role that cannot drop tables, and keep backups the agent cannot reach. Instructions like 'never touch production' are not enough; only permissions reliably stop a destructive command.

Walk it, free

Launch day · 4 minutes · Pro

Every page spins forever

Your post goes viral. Within minutes every page spins, then fails. Your database dashboard says CPU is nearly idle.

Why does my app hang with too many connections?

Each copy of a serverless function opens its own database connections, and a traffic spike runs many copies at once, so the database hits its connection limit and refuses new ones. Connect through your database's connection pooler, which shares a few connections across many requests.

Read the fix

Data you can lose · 4 minutes · Pro

Back to yesterday's version

Today's update broke checkout, so you restore yesterday's version in your builder. Now the whole app crashes.

Why does rolling back my app break it?

Rolling back restores your code, not your database. If today's migration renamed or dropped a column, yesterday's code still expects the old shape and crashes. Make schema changes additive: add the new column, switch the code, and remove the old one only when nothing uses it.

Read the fix

Teams and sharing · 4 minutes · Free

Removed, but still inside

You removed a contractor from your team at 2:00pm. At 2:40pm they downloaded the customer list.

Why can a removed user still access data?

If your security rules read the user's role from their sign-in token (JWT claims), the old role stays valid until that token expires, an hour by default in Supabase. Signing them out doesn't revoke a token already issued. Check team membership in the database inside your RLS policies, so every request sees the current team list.

Walk it, free

Data you can lose · 4 minutes · Pro

Exactly 1,000 orders

Your admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.

Why does my Supabase query return only 1000 rows?

Supabase's API returns at most 1,000 rows per request by default, and it does not raise an error when it stops. Ask the database to count instead of downloading rows, and when you need every row, paginate with a stable order such as created_at then id.

Read the fix

Don't trust the browser · 4 minutes · Pro

One coupon, fifty orders

You posted a single-use 100%-off code for a launch giveaway. Within one second it was used for fifty free orders.

Why was a single-use coupon used many times?

Because the code checks whether the coupon was used and marks it used in two separate steps. When many requests arrive at once, they all pass the check before any update happens. Make the database enforce it in one step, for example an update that only succeeds where used is false, or a unique constraint on redemptions.

Read the fix

Related terms

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Table, row, column

A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

Authorization

Checking what someone is allowed to do once you know who they are. Signed in does not mean allowed.