Guide
Your Supabase service-role key leaked. Now what?
The Supabase service-role key ignores row-level security and can read and change any data, so a leak means treat all data as reachable and act now. Rotate the key immediately in the Supabase dashboard, remove it from any client code, and move it to server-side environment variables only.
Why this one is the emergency
Most keys are limited by your rules. The service-role key is the one that ignores them. It exists so your server can do trusted work, and it can read, edit, and delete anything in your database. If it shipped in your frontend or leaked any other way, someone holding it has full access regardless of your row-level security.
Most keys are limited by your rules. The service-role key is the one that ignores them.
What to do, in order
- Rotate it now. In the Supabase dashboard, generate a new service-role key. This invalidates the leaked one.
- Remove it from client code. Search your frontend and any committed files for the old key and delete it.
- Move it server-side. The service-role key belongs only in server environment variables, used by backend code the browser never sees.
- Review what happened. Check your logs for unusual reads or writes while the key was exposed.
Then confirm you are clean
After rotating and moving the key, scan your live app to confirm no secret key is still shipping. Plaintext reads your bundle and tells you whether a service-shaped key is still there.
Frequently asked
What can someone do with a leaked service-role key?
Everything. The service-role key bypasses row-level security, so a holder can read, change, or delete any data in your Supabase project. It is the most damaging key to leak, which is why rotating it is the first step.
How do I rotate a Supabase service-role key?
In the Supabase dashboard under project API settings, generate a new service-role key. The old one stops working. Then update your server environment variables with the new key, and make sure it never appears in client code.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes Supabase-backed apps leave open. The first scan is free.
Scan my app