VibeVigilBlog · October 22, 2026
Anon key and service role are not the same
The anon key belongs in the browser. The service role key does not. Here is the short version.
Builders mix these up a lot. Supabase shows both keys on one screen.
The anon key is public. Your app sends it from the browser. Row rules decide what it can read.
The service role key skips those rules. It is for trusted server code only. If it lands in a JavaScript bundle, anyone who can load the site can copy it.
A scan treats only the service role key as a leak. It still checks tables with the anon key, because that is what a stranger can do.
If your report names the service role key, rotate it. Then delete it from client code. Do not paste the raw key into a chat. The fix note says the same thing.
The free scan shows this without an account. Saving the site is optional.
A short note. Not a promise.
If you want to know about your own site, run the free scan.
Scan a site you own. It is free. No account.
You see the report first. Saving the site is optional.