Secrets and config
Service-role key used from the front end
The database's bypass-everything key is used in client code, so row-level rules no longer protect anything.
Termsclient bundle (the JavaScript your app sends to the browser or ships inside the mobile app; anyone can read it) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · security headers (HTTP response headers (HSTS, content-type, frame policy) that switch on the browser's built-in protections) · CI (the pipeline that builds and tests every change before it can be merged or deployed)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
When a query fails under the anonymous key, a quick fix is to switch to the key that always works. Supabase's docs state the service_role key bypasses row-level security and must stay server-side.
A table in an exposed schema without row-level security is readable and writable by any role with a grant on it; the service_role key bypasses RLS and must stay server-side.
Source: Supabase docs, 2026-09 · verified 2026-09-21
A Supabase key exposed in client-side JavaScript combined with missing row-level security policies gave read and write access to a social platform's database: about 1.5 million API tokens, 35,000 email addresses and private messages. Reported 31 January 2026, patched within hours.
Source: Wiz Research, 2026-02-02 · verified 2026-09-21
How we detect it
Grep client code and bundles for the service-role key and for admin clients constructed in files that run in the browser.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Stacks: Supabase
Checklist items that catch it
No secret keys in client bundles
automated Scan the built client assets (JS, source maps, HTML) for known key prefixes and for every value present in the server environment file.
Zero matches for key prefixes (sk_, service_role, AKIA, whsec_, private keys) and zero server-only env values found in client assets.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in secrets and config
- critical
- critical
- high
- high
- medium
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.