Supabase service_role key in the frontend
The service role is the admin key. RLS does not apply to it. If the public JavaScript contains a JWT whose payload says service_role, anyone can read and write every row.
Why this happens
- The service role was pasted into the same config object as the anon key.
- A server-only file was imported by a client component.
- The key was left in a comment or a debug script that still gets deployed.
What ShipWatch looks for
- ShipWatch decodes JWTs in the public page and scripts and flags role service_role.
- It uses only the anon key for the read test, so a service role finding is not confused with a public anon key.
Prompt to paste
The Supabase service_role key is in frontend code. Remove it, rotate it in the Supabase dashboard, and keep it in a server-only environment variable. The browser may keep the anon key. Turn RLS on so the anon key cannot list other people's rows.