EngineeringScore
Exposure Medium

Rotate the exposed Supabase service-role key

Supabase issues two JWTs for a project: an anon key, meant to be public and safe in a browser because row-level security (RLS) policies govern what it can actually do, and a service_role key, meant to stay server-side because it bypasses RLS entirely and can read or write any row in any table. Confusing the two, or shipping the service_role key to the client, removes the database's access control altogether.

Why it matters

A Supabase service_role key bypasses row-level security entirely, granting full read and write access to every table in the database rather than the narrow slice an authenticated user is meant to see.

How to fix

  1. 1 Roll the service_role key in the Supabase dashboard (Project Settings > API). This is the only step that stops the old key from working.
  2. 2 Never ship the service_role key to the browser; the client should only ever use the anon key, with row-level security enforcing access.
  3. 3 Purge the old key from git history so it is not recoverable from a prior commit.
  4. 4 Redeploy and confirm the new build no longer ships the service_role key.

Common mistakes

  • Treating a leaked anon key as equivalent to a leaked service_role key: the anon key being public is by design (RLS is the real control), so the finding that actually matters is a service_role key in client code.
  • Reaching for the service_role key during development to bypass an RLS policy that was blocking a query, then shipping that shortcut to production.
  • Rotating the service_role key in the dashboard but leaving a server-side or edge function still configured with the old value.

How to verify

  1. 1 Re-run the scan and confirm the service_role finding is gone.
  2. 2 Grep the built/deployed JavaScript bundle for a JWT payload containing "role":"service_role" to confirm none remain.
  3. 3 Confirm the old service_role key is now rejected by Supabase rather than assuming rotation took effect.

Related checks

Exposure Secrets Stripe Secret KeyExposure Secrets Aws Access KeyExposure Source Maps

Ready to see where you stand?

Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.

Scan your site