Your Supabase anon key is public — and that is fine

The anon key is a public identifier for your Supabase project. It is designed to ship in browser code, exactly like a Stripe publishable key. Supabase publishes it in their own documentation and examples.

Hiding it is not possible and not the goal. Any app where the browser talks to Supabase directly must send it.

Row Level Security. With RLS enabled and a policy in place, the anon key can only read rows that policy allows — usually none, for a logged-out visitor. With RLS off, that same key reads the whole table.

So the real question is never "is my key exposed". It is "does every table have RLS on, with a policy".

A service_role key. That one bypasses every policy you have written and must never leave your server. We report it as critical, separately, because the two look identical at a glance and only differ in a field inside the token.