Supabase service_role key in the frontend

Supabase has two keys: the anon key for the frontend and the service_role key for the server. Mix them up, and the most powerful key to your database ends up in the browser.

What happens

The service_role key is written into frontend code or a public environment variable. That makes it visible to every visitor in the browser.

Why it's dangerous

The service_role key bypasses Row Level Security and has full read and write access to your database. In the frontend that means anyone can read, change or delete all data.

How Env Clinic helps

Env Clinic decodes Supabase JWTs locally, recognizes a service_role key and rates it critical in the frontend – with clear guidance.

env-clinic scan .

• Tells anon and service_role apart
• Warns about service_role in the frontend
• Explains where the key belongs