The service-role key skips every Row Level Security rule. Used in browser code, it's handed to every visitor, who can then read, change or delete your whole database.
Code that runs in the browser creates a Supabase client with SUPABASE_SERVICE_ROLE_KEY (or a key whose role is service_role).
AI tools reach for the service-role key when a query is blocked by RLS: it makes the error go away by switching security off. In browser code, the key ships to everyone.
Paste this into Lovable, Bolt, v0, Replit or Cursor:
The Supabase service-role key is used in code that runs in the browser. Move every use of it to server-side code (an API route or edge function), use the anon key in the browser, and make the RLS policies allow what the app needs. Then tell me to rotate the key in Supabase.
The full page, with the request ready to copy, is at launchpad.axonscape.com/fix/supabase-service-role-key-in-browser. I work on Launchpad by Axonscape, which runs a free launch check for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.