Supabase
Find a public Supabase service_role key
Supabase apps usually ship an anon key to the browser. That key is expected to be public, and this scan marks it as a note, not a leak. The service_role key is different. It bypasses Row Level Security. If that JWT is in the HTML or a same-origin script, anyone who loads the page can copy it.
This check cannot see your RLS policies. We do not connect to the database. A deeper RLS check is listed as coming soon, and it is not run.
What this scan actually checks
- A service_role JWT in the page, a same-origin script, or a public env file we fetch.
- An anon JWT, recorded as informational because the client is supposed to have it.
- A user JWT if one is sitting in the public code.
- The rest of the passive scan: headers, cookies, HTTPS, robots.txt, sitemap.xml, homepage links, and the .env and .git paths.
What it does not check
- We do not query tables, list buckets, or read RLS, grants, or storage policies.
- A missing service_role in the bundle does not prove RLS is on. It only means that key was not in the files we fetched.
- It does not log in, try passwords, brute-force paths, or query a database.
- It does not read third-party scripts, your Git host, or the builder's project files. If a secret never shipped in the public response, this scan will not see it.
What to do with the result
- If service_role was in client code, rotate it in the Supabase dashboard and move server work to a route that reads the key from the server environment.
- The anon key can stay in the browser. Private data still depends on RLS, which you should review in the Supabase SQL editor. This product will not do that review until ownership verification exists.
Questions
Is the anon key a finding?
We mention it as informational. The problem is a service_role key, or a secret from another provider, in the same public files.
Can you tell me if RLS is enabled?
Not in this version. The report says so, and the locked section on a scan lists Row Level Security as a later check.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.