Never ship your Supabase service_role key to the browser

Supabase gives you two keys. The anon key is meant to be public: it can only do what your Row Level Security (RLS) policies allow. The service_role key skips RLS entirely. Anyone who has it can read, change or delete every row in your database.

AI builders sometimes paste the service_role key into frontend code to "make an error go away". Anything in your frontend ends up in the JavaScript your visitors download, so the key is public the moment you deploy.

The fix: search your project for "service_role" and any key starting with "sk_". Keep those only in server-side environment variables (Supabase Edge Functions, Vercel server routes). If one was ever deployed, rotate it in the Supabase dashboard right away, then turn on RLS for every table.

Not sure what your live app exposes? Run the free 10-second scan at leakyvibe.com.