Supabase

service_role in the browser is the mistake

The anon key is supposed to be in the client. The service_role key bypasses Row Level Security. If that JWT is in the page or a same-origin script, anyone who loads the app can copy it.

• service_role in the bundle

  A service_role JWT in public files is a critical finding. Rotate it and move server work to a route that reads the key from the server environment.

• Anon key, and RLS we cannot see

  The anon key is recorded as a note, not a leak. This scan does not connect to Postgres or read policies. A quiet bundle does not prove RLS is on. That check is listed as coming soon and is not run.

• The key also sitting in a public env file

  We request /.env, /.env.local, and /.env.production. If the service_role key is in one of those responses, it is treated as already copied.

Review RLS in the Supabase SQL editor yourself. Monitor at $9/mo re-scans the public URL each week and emails if the grade drops or an issue appears or clears.