{
  "id": 18517006,
  "title": "Is the Supabase anon key safe to expose?",
  "url": "https://urgent.news/2026/11/06/is-the-supabase-anon-key-safe-to-expose",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T15:10:01.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/shipsafestack/is-the-supabase-anon-key-safe-to-expose-10ko"
  },
  "original_language": "en",
  "account": "Supabase's anonymous and publishable API keys are meant to be in the browser and are not secret keys. However, the service role and secret keys are elevated and bypass row level security (RLS), so they should never be exposed in the client. The anon key acts as a low-privilege public handle when row level security is on and grants are tight. If RLS is off or grants are wide open, the anon key becomes a public handle on a public table.\n\nTo properly set up Supabase, enable RLS for tables that the client can reach and ensure policies only check if the user is signed in without scoping rows to that specific user. The default grants should be narrower than your policies to prevent unauthorized access. The new publishable and secret keys should replace the legacy keys in your client code. Never paste live keys into a random website for decoding. Instead, check your public scripts with ShipSafeStack's free passive scan to identify any potential issues.\n\nIf you suspect that a service role key has been exposed, treat it as compromised. Remove it from the client first and replace it with a new secret key only on the server. Rotate the key with Supabase and review your logs and data.",
  "summary": "Practical checklist from ShipSafeStack . Not a penetration test, compliance audit, score, or proof that a project is safe. Informational only — no guarantees. Short answer: Supabase’s docs say the anon key, and the newer publishable key, are meant to be in the browser. They are not a secret. That only holds when row level security is on and the grants are tight. The service_role key and the newer…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}