Checks

service_role key in the browser

A JWT in the client bundle whose role claim is service_role, or a value labelled SUPABASE_SERVICE_ROLE. We show an 8-character prefix and a hash, not the key.

In plain language

The JavaScript sent to the browser contains a Supabase service_role key. That key bypasses Row Level Security.

service_role is a server secret. In a bundle it is public, in the same way a database password printed in the HTML is public. Rotate it before you do anything else.

A generic fix prompt

Paste this into your coding agent, or apply it by hand:

The client bundle contains a Supabase service_role key. Remove it from every client component and from any env var that is inlined into the browser (VITE_, NEXT_PUBLIC_, PUBLIC_). Rotate the key in the Supabase dashboard under Project Settings → API. The browser may use only the anon key. Keep service_role on the server. Search the repo for service_role and SUPABASE_SERVICE_ROLE.