Supabase service-role key 在瀏覽器端暴露，訪客可操作整個資料庫

The service-role key skips every Row Level Security rule. Used in browser code, it's handed to every visitor, who can then read, change or delete your whole database.

What you see

Code that runs in the browser creates a Supabase client with SUPABASE_SERVICE_ROLE_KEY (or a key whose role is service_role).

Why it happens

AI tools reach for the service-role key when a query is blocked by RLS: it makes the error go away by switching security off. In browser code, the key ships to everyone.

How to fix it

1. Use the anon key in the browser, and fix the RLS policy that blocked the query instead.
2. Keep the service-role key in server code only: an API route, a server action or an edge function.
3. Rotate the key in Supabase → Settings → API: it has already shipped.

Or ask your AI tool to fix it

Paste this into Lovable, Bolt, v0, Replit or Cursor:

The Supabase service-role key is used in code that runs in the browser. Move every use of it to server-side code (an API route or edge function), use the anon key in the browser, and make the RLS policies allow what the app needs. Then tell me to rotate the key in Supabase.

The full page, with the request ready to copy, is at launchpad.axonscape.com/fix/supabase-service-role-key-in-browser. I work on Launchpad by Axonscape, which runs a free launch check for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.