Supabase
Security & compliance
Legacy keys / HS256 still enabled
Part of the Auth hardening & exposure config check · fix arrives as a guide
What it is
Legacy API keys or HS256 JWT signing are still enabled on the project after a migration to the newer key format.
Why it matters
Old keys keep working, so a key leaked or shared before the migration is still valid. HS256 uses a symmetric secret, which means anything holding it to verify tokens can also mint them.
How to fix it
Move remaining clients to the current publishable and secret keys, then disable the legacy keys. Switch JWT signing to asymmetric keys so verifiers hold only a public key.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.