Your Supabase "secret" key might be in your JavaScript

Supabase gives you a public key (anon or sb_publishable_...) and a secret one (service_role or sb_secret_...). The secret key skips Row Level Security and can read or delete every row. AI builders sometimes paste it into frontend code.

Check in 2 minutes

1. Open your live site, then DevTools → Sources.
2. Search the JavaScript for sb_secret_.
3. Search for eyJ too, and decode each long token. If one says service_role, it has leaked.

Fix it

1. In Supabase → Settings → API Keys, create a new secret key and keep it in a server-only env var.
2. Deactivate the leaked legacy key, or delete the leaked secret key. Removing it from code isn't enough.
3. Turn on Row Level Security for every table.

Want a second nose? Run a free scan at sniffpup.com.