A service_role key in browser code

The service_role key is designed to bypass Row Level Security entirely — it is the key your own backend uses to do administrative work. In a browser bundle it gives every visitor full read and write access to every table, including ones you never exposed to your app.

No policy can stop it. Enabling RLS does nothing against it.

1. Rotate the key now, before fixing the code. Supabase dashboard → Project Settings → API → roll the service_role key. This invalidates the exposed one immediately.

2. Then move the code that needed it to a server route, reading the new key from a server-only environment variable — one with no NEXT_PUBLIC_, VITE_, or PUBLIC_ prefix.

3. Assume the old key was collected. Automated scrapers index public bundles continuously, and a working service_role key is the single most valuable thing they find.

Look at your Supabase logs for requests you do not recognise, and at your table row counts for unexpected changes. If the app holds other people’s personal data, take advice on whether you have a reportable breach — this is the kind of exposure that usually is one.