criticalexposurepublic probe
service_role key shipped to the browser
SERVICE_ROLE_KEY_EXPOSEDThe service_role key bypasses RLS entirely. Once it is in a client bundle it is public, and every policy in the project is decorative. Rotate the key immediately and move the calls that need it behind a server route.
What the finding looks like
criticalThe service_role key is shipped to the browser
How to fix it
There is no SQL fix. Rotate the key in the Supabase dashboard under Settings → API, which immediately invalidates it everywhere, then move whatever needed it behind a server route or edge function. RowShield stores only a fingerprint of the key it found, never the key.
Related guides
- Edge functions hold service_role — verify the boundary actually holds
- The server/client key split done wrong in Next.js + Supabase
- Rotating a service_role key that got out: rotate first
- Probe your live app: what its own public key gives away
- Detect a service_role key in your client bundle
- Check whether your Lovable app is leaking data
- Bolt.new shipped tables without RLS
What people search for
supabase service_role key leaksupabase service_role key in client bundlebolt.new supabase service_role exposed
Check your own project
This rule runs on the free probe. A URL is the only input.
Run the free audit