Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Question

Is it safe that my Supabase anon key is visible in the browser?

Solved · 5801 views · asked by gabriel_ss · edited
lovablesupabasesecurity

I opened DevTools on my own app for the first time and I can see the Supabase URL and a long key in the network requests. Can anyone use that key to get into my database? Lovable put it right in the code, not even in an env file.

What I’ve tried

Googled it, found people saying both 'it's fine' and 'never expose keys'. Asked Lovable and it said it's safe, but it also wrote the code so...

Comment
Short answer: yes, if RLS is on. Writing a longer one. mira_dev · edited

3 answers

Marked as helpful by the asker
mira_dev · edited

Yes, anyone can take that key. And that's by design: the anon key (newer projects call it the publishable key) is meant to be public, like a building's street address. What decides who gets in are the locks: Row Level Security.

So the real question is: is RLS enabled on every table, with sensible policies?

Check:

  1. Dashboard → Table Editor: any table marked 'RLS disabled' / 'Unrestricted' is readable and writable by anyone with your public key. Fix those first.
  2. Dashboard → Advisors → Security Advisor: lists tables without RLS and other issues.
  3. Test: log in as user A, try to read user B's rows from the console. Should return nothing.

The key that must never be in the browser is the service_role / secret key. That one bypasses RLS.

Comment
Security Advisor found 2 tables without RLS. Lovable fixed them when I asked. Thank you for the clear explanation! gabriel_ss · edited
The street address analogy is going in my onboarding doc for juniors. postgres_pete · edited
Coming back to this every time I start a new project, just to run the advisor. bakery_bo · edited
wes_codes · edited

Short version: anon key public = fine. service_role key public = catastrophe. Learn to tell them apart (decode the JWT at jwt.io, the role claim says anon or service_role).

Comment
Checked, it says anon. Phew. gabriel_ss · edited
rafa_dev · edited

Two blind spots when checking: Storage buckets (public buckets are readable by anyone with the URL) and database functions marked security definer, which run with the owner's rights and skip RLS. The Security Advisor flags some of these, not all.

Comment

Related

Hundreds of fake signups overnight, all with random gmail addressessolved
My admin page is just hidden from the menu, is that protection?solved
infinite recursion detected in policy for relation "profiles"solved
Google login says 'continue to xkqzjwp.supabase.co', customers think it's a scamsolved
Users can set their own role to admin through the profile updatesolved

Your answer

Sign in to write an answer