Exposed key
Supabase key exposed: what to do
service_role bypasses Row Level Security. The anon key does not, as long as your policies are actually on. This scan cannot see those policies.
How to recognize it
The dangerous value is a JWT whose role is service_role. The anon JWT is expected in the client.
What to do
Rotate the service_role key if it was in the bundle. Move server work behind a route that reads the key from the server environment. Check RLS in the Supabase dashboard yourself.
Paste the public URL of an app you own. The scan reads the page, up to 10 same-origin scripts, and /.env, /.env.local, and /.env.production. It does not search the whole internet, and it does not submit the key to Supabase to see if it still works.
What does an exposed Supabase key look like?
The dangerous value is a JWT whose role is service_role. The anon JWT is expected in the client.
Do you store the key if the scan finds one?
No. The report stores a masked fragment and the kind of key. The full value is not written to the database, and the fix prompt does not repeat it.
What should I do with a leaked Supabase key?
Rotate the service_role key if it was in the bundle. Move server work behind a route that reads the key from the server environment. Check RLS in the Supabase dashboard yourself.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.