I re-verified 30 disclosed Supabase keys. 20% were still live.
I re-verified 30 disclosed Supabase keys. 20% were still live. The uncomfortable finding: developers who thank you for reporting a leaked key — and swear they rotated it — often don't. by Cenk Kurtoglu — I audit Supabase/Postgres access control for a living (github.com/cekuu35) The setup Over the last two months I've disclosed dozens of committed Supabase service_role keys to maintainers. The…
Over the last two months, writer Cenk Kurtoglu disclosed dozens of committed Supabase service_role keys to maintainers. He found that 20% of the previously-disclosed repositories still had a working master key in public code. Many developers thanked Kurtoglu for reporting the leaked key and claimed they rotated it, but he tested the keys again and found that the rotation did not always work.
The process for rotating a Supabase key is confusing and many developers miss steps or fail to update all locations where the key is stored. To check if a key is still live, Kurtoglu recommends decoding the committed JWT, pinging the Supabase REST endpoint with the key as both apikey and Authorization: Bearer, and checking for a 200 or 401 response.
If a 200 response is received, the key is still live and needs to be rotated. Kurtoglu offers rotation verification as a fixed-scope service, where he can re-test every key he has reported and provide a two-line verdict of whether the key is live or dead, along with evidence.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
