public credential
supabase-publishable-key· SupabaseSupabase publishable key
Intended for the browser. Access is constrained by Row Level Security.
This is not a leak
KeyDrift matches this format on purpose, and then excludes it from the finding count. Recognising it is what makes the rest of the report trustworthy — a scanner that cannot tell this apart from a secret will either flag it and cry wolf, or stay quiet about the secret sitting next to it.
How it is detected
Matches the `sb_publishable_` prefix, the browser-facing half of Supabase’s 2024 key format. Reported as a public credential: it is the replacement for the anon key and access through it is constrained by Row Level Security.
What to do
- 1Nothing to rotate. This credential is designed to be public.
Where it turns up
Most often in client bundles built by AI coding tools.