---
title: "My Supabase service_role key is in the browser"
description: "A Supabase secret key in the browser lets anyone read or delete every table. How to confirm it, rotate the key and move admin code server side."
url: https://whocanfixmyapp.com/problems/supabase-secret-key-in-the-browser
---

[Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Data and database](https://whocanfixmyapp.com/problems#data-and-database)

# My Supabase service_role key is in the browser

VC-37 · Supabase · Lovable · Bolt · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley)

Quick verdict

Get an engineer for this one. Rotating is quick, moving the code server side is not

- **How serious**: Critical
- **Fix it yourself?**: No, get an engineer
- **Typical cost**: €99–$990 for a single fix, $1,500–$15,000 if several features depend on it ([prices](https://whocanfixmyapp.com/pricing))
- **Top rated for Supabase**: [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10

**What you see.** A scan, a developer or your own search of the live site's JavaScript found a key starting with sb_secret_ or a service_role token.

## Why it happens

Supabase gives every project two kinds of keys. The publishable key (prefix `sb_publishable_`, or the older anon key) is designed to ship to the browser. Row Level Security, the rules on each table, decides what it can reach. The secret key (prefix `sb_secret_`, or the older service_role token) bypasses those rules completely. Supabase says to only use it in backend components of your app, and never in a browser, including on localhost.

AI builders put the secret key in the frontend when you ask them to make an admin page work or to get past a permission error. In a Vite app like a Lovable or Bolt export, every `VITE_` variable is embedded at build time, so the key sits in a JavaScript file anyone can open. Whoever finds it can read, change or delete every row in every table, and the key keeps working from other tools until you retire it.

## Fix it yourself

1. Confirm it. Open your live site, press F12, open the **Sources** or **Network** tab and search the loaded JavaScript for `sb_secret_` and `service_role`.
2. Treat the key as leaked. In Supabase go to **Settings > API Keys** and create a new secret key. Do not delete the old one yet.
3. Replace the old key everywhere it runs on a server, such as Edge Functions and webhook handlers. Only then delete the compromised key. Supabase warns that deleting cannot be undone.
4. If the leaked key was a legacy service_role token, deactivate the legacy keys on the same page once nothing uses them. Deactivation is reversible if you missed a client.
5. Ask your builder to move the admin logic into a server function that checks the caller is an admin, and to use the publishable key in the browser.
6. Write proper table policies instead of bypassing them. See [Users can see each other's data](https://whocanfixmyapp.com/problems/users-can-see-each-others-data).

## When to get an engineer

Hire an engineer when the key was live for more than a day, when more than one feature depends on it, or when you are not sure which server code uses it. Tell them when the key was deployed, which features broke when you removed it, and share the repository link. A single fix (rotation plus one feature moved server side) runs €99–$990. A cleanup where several admin features need server functions runs $1,500–$15,000. A one-off check for $49–$800 finds other leaks at the same time.

## Top-rated companies for Supabase apps

Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score).

- 1 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490
- 2 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299
- 3 · [LazyCodeLab](https://whocanfixmyapp.com/companies/lazycodelab) · **9.0**/10 · Best for: A one-off check and a cleanup · From $399

[All 29 Supabase companies, ranked](https://whocanfixmyapp.com/best/supabase-developers)

## Check these

DATA-02 · Critical

No secret keys reach the browser

Open your live app, then DevTools, Sources, and search the loaded JavaScript for `sb_secret_`, `sk_live_`, `sk-proj-` and `sk-ant-`. Older Supabase keys are long tokens starting with `eyJ`: decode the middle part of each on your own machine, and if it contains `"role":"service_role"`, your secret key is public. A publishable or anon key in the browser is expected.

DATA-01 · Critical

Access rules are on for every table

In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say `allow read, write: if true`.

DATA-05 · High

Admin actions are checked on the server

Hiding an admin button is not protection. Call the admin endpoint as a normal user and confirm it is refused.

OPS-04 · Medium

Secrets live in the host's environment settings

Keys belong in environment variables on the server, not in the repository or in front-end code.

## Questions

### Is my publishable or anon key also a leak?

No. Supabase lists web pages and mobile apps as safe places for the publishable key. Your table policies, not the key, protect the data.

### Can I just delete the key right now?

If server code still uses it, deleting it first takes your app down. Create the new key, swap it in, then retire the old one. Supabase also notes that creating new keys does not revoke the legacy ones.

Sources: [Supabase docs: API keys](https://supabase.com/docs/guides/getting-started/api-keys); [Supabase docs: Migrating to publishable and secret API keys](https://supabase.com/docs/guides/getting-started/migrating-to-new-api-keys); [Supabase docs: Row Level Security](https://supabase.com/docs/guides/database/postgres/row-level-security); [Lovable docs: Deploying and hosting outside Lovable](https://docs.lovable.dev/tips-tricks/external-deployment-hosting).

**Lovable guide**

What Lovable builds, where it breaks and how to check it: [Lovable app rescue: what breaks and how to check it](https://whocanfixmyapp.com/guides/lovable).

**Same category**

- [Data saves with no error but never shows up](https://whocanfixmyapp.com/problems/data-saves-with-no-error-but-never-shows-up)
- [Supabase project paused or free tier limit reached](https://whocanfixmyapp.com/problems/supabase-project-paused-or-free-tier-limit)
- [I have no backups and don't know how to restore](https://whocanfixmyapp.com/problems/no-backups-and-i-dont-know-how-to-restore)
- [Test data and real customer data are in one database](https://whocanfixmyapp.com/problems/test-data-mixed-with-real-customer-data)
- [Firebase rules are set to allow read, write: true](https://whocanfixmyapp.com/problems/firebase-rules-allow-read-write-true)
- [App got slow once real users arrived](https://whocanfixmyapp.com/problems/app-got-slow-once-real-users-arrived)

[All data and database problems](https://whocanfixmyapp.com/problems#data-and-database)

**Run every check**

The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.