My service role key was in a public repo for 3 weeks, what do I do first?

Order matters. Making the repo private doesn't help much; forks and scrapers already have it. Do this now:

1. Rotate the key. In Supabase → Project Settings → API Keys. If your project uses the newer secret keys (sb_secret_...), create a new one and delete the old one. If it's the legacy JWT service_role key, you have to rotate the JWT secret; that also changes the anon key and logs everyone out, which is acceptable here.
2. Update the app to use the new key from an env var (server-only), redeploy.
3. Check for damage: Supabase logs (API/Postgres) for unusual queries from unknown IPs, row counts, deleted data.
4. Then clean history (git filter-repo) mostly for hygiene.

The app will break for a few minutes between 1 and 2. That's fine.

About not knowing: if you can't rule out access, many jurisdictions (GDPR in the EU for example) expect you to assess whether it's a reportable breach, and journal entries are sensitive. Not legal advice, but write down the timeline now (when public, when found, when rotated) while you remember it. You'll need it whatever you decide.

Also GitHub has secret scanning alerts; check the repo's Security tab. If a scanner partner notified GitHub, it may show there when it was detected.