Checks

Anon key in the client

A Supabase JWT with role anon. This is informational. The anon key is public by design.

In plain language

The Supabase anon key is in the client bundle. That is expected. The anon key is public by design.

The anon key identifies the project. It is not a secret. Protection comes from grants and Row Level Security, not from hiding this key.

A generic fix prompt

Paste this into your coding agent, or apply it by hand:

No rotation needed for the anon key. Confirm the browser uses the anon key and not the service_role key. Then check RLS on every table the anon and authenticated roles can reach.