Protect sensitive API keys

Never expose keys with elevated privileges (such as `service_role` or secret keys) in client-side code. These keys can bypass Row Level Security (RLS) and provide unrestricted access to your data.

copy reviewer prompt

Prompt

Reviewer Prompt
Deploy Agent

Never expose keys with elevated privileges (such as service_role or secret keys) in client-side code. These keys can bypass Row Level Security (RLS) and provide unrestricted access to your data.

Always use elevated privilege keys only in server-side environments like:

  • Backend servers
  • Edge Functions
  • Secure CI/CD pipelines

For client-side applications, only use the publishable or anon key, and ensure Row Level Security is properly configured on all tables to protect your data.

// WRONG - Never do this in client-side code
const supabase = createClient(
  'https://your-project.supabase.co',
  'SUPABASE_SERVICE_ROLE_KEY' // Dangerous!
)

// CORRECT - Server-side code only (e.g., Edge Function)
const supabaseAdmin = createClient(
  Deno.env.get('SUPABASE_URL') ?? '',
  Deno.env.get('SUPABASE_SERVICE_ROLE_KEY') ?? '' // Secure, from environment variables
)

// CORRECT - Client-side code
const supabase = createClient(
  'https://your-project.supabase.co',
  'SUPABASE_ANON_KEY' // Safe with proper RLS policies
)

Additionally, ensure sensitive files containing keys (like .env files or .sentryclirc) are added to .gitignore to prevent accidental exposure through version control.

Source discussions