{"slug": "supabase-service-role-key-exposed-in-the-browser", "title": "Supabase service-role key exposed in the browser", "summary": "A developer at Axonscape's Launchpad documented a common security flaw in AI-built apps: Supabase's service-role key, which bypasses all Row Level Security, is frequently placed in browser-side code by AI coding tools like Lovable, Bolt, v0, Replit and Cursor when RLS blocks a query, exposing the entire database to every visitor. The team published a fix prompt directing developers to move the key to server-side code, use the anon key in the browser, tighten RLS policies and rotate the key, alongside a free launch check that scans public GitHub repos or uploaded code to catch this and other pre-launch failures.", "body_md": "The service-role key skips every Row Level Security rule. Used in browser code, it's handed to every visitor, who can then read, change or delete your whole database.\n\nCode that runs in the browser creates a Supabase client with `SUPABASE_SERVICE_ROLE_KEY` (or a key whose role is `service_role`).\n\nAI tools reach for the service-role key when a query is blocked by RLS: it makes the error go away by switching security off. In browser code, the key ships to everyone.\n\nPaste this into Lovable, Bolt, v0, Replit or Cursor:\n\nThe Supabase service-role key is used in code that runs in the browser. Move every use of it to server-side code (an API route or edge function), use the anon key in the browser, and make the RLS policies allow what the app needs. Then tell me to rotate the key in Supabase.\n\nThe full page, with the request ready to copy, is at [launchpad.axonscape.com/fix/supabase-service-role-key-in-browser](https://launchpad.axonscape.com/fix/supabase-service-role-key-in-browser). I work on Launchpad by Axonscape, which runs a [free launch check](https://launchpad.axonscape.com/check) for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.", "url": "https://wpnews.pro/news/supabase-service-role-key-exposed-in-the-browser", "canonical_source": "https://dev.to/axonscape/supabase-service-role-key-exposed-in-the-browser-49ce", "published_at": "2026-11-04 09:40:53+00:00", "updated_at": "2026-11-04 09:52:22.941023+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-products", "developer-tools"], "entities": ["Supabase", "Axonscape", "Launchpad", "Lovable", "Bolt", "v0", "Replit", "Cursor"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/supabase-service-role-key-exposed-in-the-browser", "markdown": "https://wpnews.pro/news/supabase-service-role-key-exposed-in-the-browser.md", "text": "https://wpnews.pro/news/supabase-service-role-key-exposed-in-the-browser.txt", "jsonld": "https://wpnews.pro/news/supabase-service-role-key-exposed-in-the-browser.jsonld"}}