Home/Wiki Errors/Vibe Coding
Vibe Coding / Secrets

Supabase anon key exposed in frontend

The public anon key may be normal, but exposing service role keys or relying on anon without RLS is dangerous.

Error text / 报错原文

  • Supabase anon key exposed
  • NEXT_PUBLIC_SUPABASE_ANON_KEY
  • service role key exposed

What it means

The public anon key may be normal, but exposing service role keys or relying on anon without RLS is dangerous.

Most common causes

  • Service role key put in browser env
  • Missing RLS policies
  • Generated docs confuse anon and service role
  • Secrets committed into Git

Fastest fix

  • Reproduce the smallest failing case.
  • Check environment, platform, and production settings.
  • Use the related local tool to classify the issue.
  • Fix the highest-risk security or data issue first.

Safe fix

  • Keep secrets out of client code and logs.
  • Prefer least privilege and explicit allowlists.
  • Add a regression test or checklist before retrying.
  • Document the working production configuration.

What not to do

  • Do not disable security controls as a permanent fix.
  • Do not paste secrets into public issue trackers or AI chats.
  • Do not trust preview success as production readiness.

Diagnostic commands

npm run build
git diff --check
grep -R "SERVICE_ROLE\|STRIPE_SECRET\|SUPABASE" .

Related tools

Related errors

Sources