Skip to content
VibeVigil
Log inSign up

Guides · VibeVigil

Is a Supabase service role key safe in the browser?

No. The service role key skips row security. Keep it on the server. Rotate it if it shipped in JavaScript.

Scan a site you own. It is free. No account.

You see the report first. Saving the site is optional.

No account. The report is the next page.

Free, no account. We fetch the public page, its scripts, and a few well-known paths.

No. The service role key is not safe in the browser.

Supabase gives you two keys. The anon key is meant for the browser. The service role key is not. The service role key can read and write tables even when row security is on.

If that key is in a JavaScript file, anyone can copy it. They only need to open your site and view the source.

What to do

  • Remove the service role key from client code.
  • Rotate the key in the Supabase dashboard so the old one stops working.
  • Keep privileged work in a server route. The browser should call your route, not use the service role key.

What a scan does

A free scan reads the public page and the JavaScript it loads. If it sees a service role key, it says so in plain words. It stores only a short masked preview, not the full key. It also gives you a fix note you can paste into Cursor, Lovable, or Claude.

The anon key can stay. The service role key cannot.

The page explains the check. A scan uses your URL.

You see the report before you make an account.

Is a Supabase service role key safe in the browser? · VibeVigil