Your Supabase anon key is visible in the browser. Is that a problem?

Short version: the anon (publishable) key is meant to be public — as long as Row Level Security is on. The key that must never leak is the other… Aliteq Sam Ortega · Build Editor

If the key you found is the anon (now called publishable) key, seeing it in the browser or on GitHub is fine — it's designed to be public. Supabase describes it like a building: the publishable key…

Anon / publishable key public — fine by design, if RLS is on

RLS is the protection — it limits what the public key can reach

Secret / service_role key — must never be in a browser, app or repo

If the secret leaked — fix the cause, then rotate it

If a secret (service_role) key has been public and your app holds other people's data, don't just rotate and move on — have someone check whether anything was accessed with it while it was exposed.…

When to stop and hire someone

Read the full story

Aliteq Your Supabase anon key is visible in the browser. Is that a problem? Read the full story on Aliteq