VibeVigilGuides · VibeVigil
Is the Supabase anon key a secret?
No. The anon key is meant to be in the browser. Row security is what protects your data.
Scan a site you own. It is free. No account.
You see the report first. Saving the site is optional.
No. The Supabase anon key is not a secret.
Supabase expects that key in your browser app. Hiding it does not secure the database. Row level security does.
A scan will not call the anon key a leaked secret. It will still use the key, only as a stranger could, to see which tables are readable. Table names are saved. Rows are not.
If you also see the service role key in the same file, that one is a real leak. Rotate it and move it to the server.
You can run this check with no account. The report shows up first. Save the site only if you want it watched.
The page explains the check. A scan uses your URL.
You see the report before you make an account.