Answers

Answers.

Short answers to questions people search for before launching on Supabase and Stripe. Each one answers in the first paragraph, then gives the commands to check it yourself.

Supabase

Is my Supabase anon key safe to expose?

Yes, if Row Level Security is on for every table it can reach. The anon (publishable) key is meant to ship in your frontend; the service_role (secret) key is not. Four checks to run.

Stripe

How do I find Stripe subscriptions still active after a failed payment, or with expiring cards?

List subscriptions with status past_due and unpaid, check open invoices on active ones, and compare each default card's expiry date with this month. API calls, Dashboard settings, and what to do with the results.

Stripe

Why does my Stripe webhook accept unsigned events?

Because verification is your handler's job, not Stripe's. The usual causes (no constructEvent call, a skipped check when the secret is unset, a swallowed error) and three curl tests to confirm the fix.