Supabase
Security & compliance
Anon-key client used for a privileged write
Part of the Auth & service-role key safety check · fix arrives as a guide
What it is
The anon-key client performs an insert, update, or delete on a sensitive table.
Why it matters
The anon key is public and present in the browser, so the only thing standing between an unauthenticated request and that write is your RLS policy. If the policy is missing or permissive, anyone can perform the mutation.
How to fix it
Use an authenticated client carrying the user's JWT for mutations, and confirm the table has RLS policies restricting writes to the row owner. Treat the anon key as an identifier, not a permission.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.