Supabase service-role key exposed in the browser
The service-role key skips every Row Level Security rule. Used in browser code, it's handed to every visitor, who can then read, change or delete your whole database. What you see Code that runs in the browse
The service-role key skips every Row Level Security rule. Used in browser code, it's handed to every visitor, who can then read, change or delete your whole database.
What you see
Code that runs in the browser creates a Supabase client with SUPABASE_SERVICE_ROLE_KEY (or a key whose role is service_role).
Why it happens
AI tools reach for the service-role key when a query is blocked by RLS: it makes the error go away by switching security off. In browser code, the key ships to everyone.
How to fix it
- Use the anon key in the browser, and fix the RLS policy that blocked the query instead.
- Keep the service-role key in server code only: an API route, a server action or an edge function.
- Rotate the key in Supabase β Settings β API: it has already shipped.
Or ask your AI tool to fix it
Paste this into Lovable, Bolt, v0, Replit or Cursor:
The Supabase service-role key is used in code that runs in the browser. Move every use of it to server-side code (an API route or edge function), use the anon key in the browser, and make the RLS policies allow what the app needs. Then tell me to rotate the key in Supabase.
The full page, with the request ready to copy, is at launchpad.axonscape.com/fix/supabase-service-role-key-in-browser. I work on Launchpad by Axonscape, which runs a free launch check for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.
Originally published by Dev.to AI. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.