Guides / Supabase service_role key exposed

Supabase service_role or secret key exposed in your frontend

Why a Supabase service_role / secret key in your browser code is critical, how to find it, and how to remove and rotate it.

What it is

Supabase has two kinds of keys. The publishable (formerly anon) key is safe in the browser because RLS limits what it can do. The secret (formerly service_role) key bypasses Row Level Security completely. Supabase says it must never leave your control. If an AI tool pasted it into frontend code or a VITE_ / NEXT_PUBLIC_ variable, anyone can download it from your site and read, change or delete all your data.

How to check

1. Search your code for service_role and sb_secret_.
2. Check your env files: any Supabase secret key in a variable starting with VITE_ or NEXT_PUBLIC_ is shipped to the browser.
3. Open your live site, view the JavaScript files in your browser’s developer tools and search for the same strings.
4. Or let Cobalt Owl search your public JavaScript bundles for you.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

My frontend contains the Supabase service_role / secret key, which bypasses Row Level Security. Remove it from all client code and from every env variable exposed to the browser (VITE_, NEXT_PUBLIC_). Use only the publishable/anon key in the client. Move any admin operations into a Supabase Edge Function that reads the secret key from Edge Function secrets. Then list the steps to rotate the key in the Supabase dashboard.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• Supabase: Understanding API keys
• Supabase: Edge Function secrets

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.