critical
supabase-secret-key· SupabaseSupabase secret key
Full read and write access to every table, bypassing Row Level Security.
How it is detected
Matches the `sb_secret_` prefix introduced with Supabase’s 2024 key format. Unlike the legacy JWT there is no payload to inspect: the prefix alone is the claim.
If you find one
- 1Rotate the key in Project Settings → API. The old one stops working immediately.
- 2Move whatever needed it into an Edge Function or a server route, and keep only the anon key in the browser.
- 3Check Row Level Security is enabled on every table — a leaked service_role key bypasses it, so RLS is what limits the damage from the next one.
Where it turns up
Most often in client bundles built by AI coding tools.