critical
supabase-access-token· SupabaseSupabase personal access token
Management API access: can read, modify and delete every project on the account.
How it is detected
Matches the `sbp_` management API prefix. This is an account-level token, not a project one — it reaches every project the owner has.
If you find one
- 1Rotate the key in Project Settings → API. The old one stops working immediately.
- 2Move whatever needed it into an Edge Function or a server route, and keep only the anon key in the browser.
- 3Check Row Level Security is enabled on every table — a leaked service_role key bypasses it, so RLS is what limits the damage from the next one.
Where it turns up
Most often in client bundles built by AI coding tools.