Fixes › Env vars & leaked keys

Supabase service_role key exposed in frontend code

LovableBoltv0Cursor

The error

service_role key found in the JS bundle / NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY

Why it happens

The service_role key bypasses Row Level Security entirely. If it is in client code or in any NEXT_PUBLIC_/VITE_ variable, anyone can open DevTools, copy it and read or delete your whole database.

How to fix it

1. Rotate the key immediately in Supabase → Project Settings → API (rotate JWT secret / API keys).
2. Remove it from all client-side code and public env vars.
3. Use only the anon/publishable key in the browser and rely on RLS.
4. Move privileged operations into a server route or Supabase Edge Function that reads the secret from server-side env.

Fix prompt (paste into Lovable, Bolt, Cursor, Replit or v0)

Audit this project for any use of the Supabase service_role key in client-side code or in env vars prefixed NEXT_PUBLIC_ or VITE_. Remove it from the client, use only the anon key in the browser, and move any operation that needs elevated access into a server-side API route or Supabase Edge Function that reads SUPABASE_SERVICE_ROLE_KEY from server env. List every file you changed.

FAQ

Is the anon key safe to expose?

Yes, it is designed to be public, as long as RLS policies protect your tables.

I already deployed it. What now?

Rotate it first, then fix the code. Assume it was copied.

Related fixes

• OpenAI / Stripe secret key leaked in the browser
• Environment variable is undefined in production
• OpenAI 429 'You exceeded your current quota' or a surprise AI bill
• .env file committed to GitHub