Skip to content
BuildThenTestedSee packages
HighData integrity

No backup that has ever been restored

When data is deleted or corrupted, whether by a bug, an agent or a person, there is either nothing to restore or a backup nobody has proven they can actually bring back. Whether stored data stays correct over time. Check it yourself with the steps below; our test adds what a script and a second account can find.

What it looks like

# Database provider dashboard: Settings > Database > Backups
Plan: Free
Daily backups: not included on this plan
Point in Time Recovery: not enabled
# Last manual export: never
# Last restore rehearsal: never
A backups page for a production project on a plan with no automatic backups, no manual export ever taken, and no record of a restore having been tried.

What happens

When data is deleted or corrupted, whether by a bug, an agent or a person, there is either nothing to restore or a backup nobody has proven they can actually bring back.

Where it shows up

Descriptive, not a verdict: builders and stacks whose defaults make this reachable, or that a public incident names. Each hub states the tool's own security features.

Seen in public

In July 2025 a Replit agent deleted data from a production database during a user-declared code freeze; Replit's CEO confirmed it, said backups allowed a restore, and announced automatic dev and production database separation.

  • 2025-07-18 User's report on X
  • 2025-07-20 Replit CEO confirmation on X

Jul 2025 · Jason Lemkin (SaaStr) · all sources

Check it yourself

Uses your builder's dashboard and your browser. No tools to install.

  1. Open your database provider's dashboard and find the backups page (Supabase: Database, then Backups; Replit: the Database tool, then restore options).
  2. Note whether a backup from yesterday exists and how far back the list goes.
  3. If one exists, restore it into a fresh project or branch, never into production, and open the app against that copy.
  4. Bad result: no backup is listed, a restore has never been tried, or the restored copy does not work because storage files, auth users or settings live outside the backup.

What we check

We map every place your data lives (database, file storage, auth users, third-party services) and whether each has a backup with a stated retention. We then rehearse a database restore into a scratch project, time it, and report what did not come back.

Fix direction

Turn on your provider's automatic backups or point-in-time recovery for production and write down what they do not cover, such as storage files and auth configuration. Rehearse a restore into a scratch project once a quarter, and keep the steps and timing where the whole team can find them.

Mechanism documented in: Database Backups (verified 2026-09-21); Data recovery (verified 2026-09-21).

Covered by

Full audit ($1,900, 5 business days)

Both include a re-check after your fixes.

Compare packages

Related patterns

  • AI agent with production credentialsDeploy and config

    Anything the agent decides to run, or is tricked into running by text it reads, executes with the same power you have, including dropping tables or moving money.

    Critical
  • Every change goes straight to productionDeploy and config

    A broken build, a bad migration or an agent's misjudged edit reaches real users and real data first, with no place where it could have been caught.

    Medium
  • Deletes with no soft delete or audit trailData integrity

    One wrong click, a bug in a filter, or an abused account removes customer data for good, and nobody can say afterwards what was lost or who removed it.

    High
  • Migrations that cannot be undoneData integrity

    When the change turns out to be wrong, the old column values and deleted rows are already gone, and the only way back is a full restore from backup, if one exists.

    Medium

Questions

does supabase back up my database automatically

Supabase's backup docs state that automatic daily backups come with Pro, Team and Enterprise plans, with retention that grows by tier, and that point-in-time recovery is a paid add-on with finer granularity. Projects on the free plan are directed to export data themselves with the CLI. Check your project's plan and Backups page rather than assuming.

how do i test a database backup restore

Restore the most recent backup into a new project or database branch, point a copy of the app at it, and try the core actions: sign in, open records, create something. Note how long it took and what was missing, such as uploaded files or user accounts held in a separate service. A backup that has never been restored is a hope, not a plan.

has an ai coding agent deleted a production database

In July 2025 a Replit agent deleted data from a production database during a user-declared code freeze (Jason Lemkin (SaaStr), 2025). Replit's CEO confirmed it, said backups allowed a restore, and announced automatic separation of development and production databases. Replit's docs now describe checkpoint rollback for development databases and point-in-time restore for production ones. Whatever your provider, open its backups page today and confirm a restore point exists for production.

Back to the catalogue, or run the self-check for your stack.