Common problem

Is your Supabase service_role key in your front-end code?

Supabase gives you two kinds of keys. The public (anon or publishable) key is made for the browser. The service_role or secret key skips Row Level Security, so it must stay on a server.

Check your live app for free

Paste your link. The free summary usually takes under a minute.

How it happens

Admin code that needs the service_role key gets written in the front end, so the key ships to the browser.

Even with only the public key, your data is only as safe as your Row Level Security (RLS) rules.

What our scan checks

  • We look for a Supabase service_role key or secret key (sb_secret_) in your public JavaScript.
  • If we only find the public key, we remind you to check RLS. We never query your database.
Example fix prompt

Fix prompt from a full report (service_role key found)

Paste this into your AI builder
In my AI app builder (Lovable, Bolt, Cursor, Replit, v0 or similar):
My Supabase service_role key is in my front-end code.
1. Remove it from all client code. In the browser, only use the anon (public) key.
2. Move any code that needs admin access into a Supabase Edge Function or a server API route that reads the key from a server-only env variable.
3. Show me every file you changed.
(I will rotate the service_role key / JWT secret in the Supabase dashboard myself.)

The full report gives a prompt like this for every issue it finds, written for your site.

This is an automated, surface-level check of what your site shows the public. It is not a full security audit.