Is the Supabase anon key safe to expose?
Practical checklist from ShipSafeStack . Not a penetration test, compliance audit, score, or proof that a project is safe. Informational only — no guarantees. Short answer: Supabase’s docs say the anon key, and the newer publishable key, are meant to be in the browser. They are not a secret. That only holds when row level security is on and the grants are tight. The service_role key and the newer…
Supabase's anonymous and publishable API keys are meant to be in the browser and are not secret keys. However, the service role and secret keys are elevated and bypass row level security (RLS), so they should never be exposed in the client. The anon key acts as a low-privilege public handle when row level security is on and grants are tight. If RLS is off or grants are wide open, the anon key becomes a public handle on a public table.
To properly set up Supabase, enable RLS for tables that the client can reach and ensure policies only check if the user is signed in without scoping rows to that specific user. The default grants should be narrower than your policies to prevent unauthorized access. The new publishable and secret keys should replace the legacy keys in your client code. Never paste live keys into a random website for decoding. Instead, check your public scripts with ShipSafeStack's free passive scan to identify any potential issues.
If you suspect that a service role key has been exposed, treat it as compromised. Remove it from the client first and replace it with a new secret key only on the server. Rotate the key with Supabase and review your logs and data.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
