Supabase · keys in the browser

Is my Supabase anon key exposed?

Yes — and it is supposed to be. The anon (publishable) key ships in every copy of a Supabase front end. Whether that exposes your data depends on two other things. Check what your live app hands every visitor:

✓ Passive check · reads only what your app already sends every visitor · nothing is stored

  1. 1 · what goes wrong

    The anon key is public by design

    Supabase built the anon key to sit in the browser. On its own it grants exactly what your row-level security policies allow the anonymous and signed-in roles to do, and nothing more.

    With row-level security in force on every table, the key in the page is harmless. With one table left open, the same key reads that table for anyone.

  2. 2 · what goes wrong

    The secret key is not

    The secret (sb_secret_…) or legacy service-role key bypasses row-level security completely. It belongs on a server. It reaches the browser when a server-side variable is read in front-end code, or when a prompt pastes it into a client file.

    Anyone who opens the page can read and change every row in every table, with no account and no trace, until that key stops working.

  3. 3 · what goes wrong

    Other keys in the same bundle

    Stripe secret keys, OpenAI or Anthropic keys and mail-service keys end up in front-end bundles the same way.

    Your bill, your customers' payments or your sending domain, in a stranger's hands.

Questions people ask

Should I hide my Supabase anon key?

It cannot be hidden: the browser needs it to talk to Supabase, so anyone can read it from your app. That is expected. What has to be right is row-level security on every table, and that no secret or service-role key is in the browser.

How do I know if my service-role key is in my bundle?

The free check on this page reads the scripts your address serves and names any Supabase secret or service-role key it finds there — the kind and the file, never the value.

My anon key was in a public GitHub repo. Is that a leak?

The anon key is public anyway, so on its own, no. A secret or service-role key in a public repository is: treat it as known to everyone.

An address shows only what a visitor sees. Row-level security policies, backups, tests and secrets with fallback defaults are in your code: the full check reads 118 of them inside Claude Code, Cursor or Codex, free. The full check, in your coding tool →

When you want the gaps closed the way serious software teams close them, the same prodready connection runs the SDLC on your project.