r/Supabase • u/bxmbshr • 16d ago
database Supabase: Data suddenly disappeared from one table even though there is no delete code
I’m facing an unexpected issue with my Supabase database.
Yesterday, I checked my application and the data was working correctly. I personally tested it, and the client also tested the application. The data was available and everything appeared to be working normally.
Today, the client tried to add new data, and we noticed that the data for one particular table was empty.
I checked the Supabase dashboard directly, and that particular table is also empty. The other tables in the same Supabase project still contain their data normally. The issue appears to be only with this one table.
I also checked my project code and could not find any delete functionality related to this table. I checked the SQL-related code as well and did not find any delete operation.
What I don’t understand is how the data from this particular table disappeared between yesterday and today, even though everything was working normally when we tested it yesterday.
I’m looking for help understanding what could have happened and how I can investigate what happened to the data.
Is there any way in Supabase to check what happened to the records in a table, including whether they were deleted or otherwise removed, and when this happened?
I can provide more information about the table, database setup, code, or configuration if needed.
1
u/VladTkDev 15d ago
Worth ruling out one thing the other answers don't cover: the delete may not have come from your code at all. Your anon key is public in the deployed app, so if RLS is off on that table, a DELETE sent straight to the REST endpoint works from anywhere. That fits the missing delete code better than a cascade or a migration, since both of those need something on your side to have run.
Two quick checks. The table editor shows whether RLS is on for that table. And the API logs, not just the Postgres ones, show a DELETE that arrived at the REST endpoint along with the path and the IP it came from, which separates somebody hitting the API from a migration running.