criticalexposurepublic probe
service_role key shipped to the browser
SERVICE_ROLE_KEY_EXPOSEDThe service_role key bypasses RLS entirely. Once it is in a client bundle it is public, and every policy in the project is decorative. Rotate the key immediately and move the calls that need it behind a server route.
What the finding looks like
criticalThe service_role key is shipped to the browser
How to fix it
There is no SQL fix. Rotate the key in the Supabase dashboard under Settings → API, which immediately invalidates it everywhere, then move whatever needed it behind a server route or edge function. VibeGuard stores only a fingerprint of the key it found, never the key.
Related guides
What people search for
supabase service_role key leaksupabase service_role key in client bundlebolt.new supabase service_role exposed
Check your own project
This rule runs on the free probe. A URL is the only input.
Run the free audit