Supabase
Security & compliance
Service-role key exposed in client-side code — full RLS bypass
Part of the Auth & service-role key safety check · fix arrives as a pull request
What it is
The service-role key — or a NEXT_PUBLIC_ prefixed equivalent — is referenced from a value that ends up in the browser bundle.
Why it matters
This key bypasses every RLS policy by design. Anyone who opens devtools can read or modify any row in the database, and no policy you write will stop them, because the key exists to ignore policies.
How to fix it
Rotate the key immediately, then move the service-role client into a server-only module — a route handler or server action. Never give a service-role key a client-bundle prefix.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.