Leaked secret · Database

Your Supabase service_role key
is exposed in .env?

Don't panic — but move fast. A committed or client-side SUPABASE_SERVICE_ROLE_KEY gives anyone your entire Supabase database — it bypasses Row Level Security completely. Rotate it now, then make sure nothing else leaked.

Looks like
SUPABASE_SERVICE_ROLE_KEY=eyJ… (service_role JWT)

What an attacker can do with a leaked Supabase service_role key

⚠

Read and write every row in every table, ignoring all RLS policies

⚠

Dump your full user table, auth data and private records

⚠

Delete or ransom your whole database

Fix it right now — rotate your Supabase service_role key

  1. 1Supabase Dashboard → Project Settings → API → Reset/rotate the service_role key.
  2. 2Update SUPABASE_SERVICE_ROLE_KEY in server-side env only — it must never reach the browser.
  3. 3Audit your RLS policies and recent table activity for unauthorised access.
  4. 4Remove the key from git history and any client-shipped code.

Removing the key from your latest commit isn't enough — it stays recoverable in git history until you scrub it. We do that (and find anything else you missed) in the free audit.

Not sure what else leaked? We'll scan your whole repo — free, in 48 hours.