Platform

Security fixes

Keys that must never ship in the browser, and how to rotate them.

2 fixes, most common first.

1. 17

   Rank 17. Supabase service_role or secret key exposed in front-end code

   Is your Supabase service_role or sb_secret key in your browser code? Anyone can read it and bypass all security. How to rotate and fix it.

   • Supabase
   • Lovable
   • Bolt
   • Cursor
   • v0
   • Security
2. 31

   Rank 31. Invalid JWT after switching to sb_publishable or sb_secret keys

   The app broke after Supabase's new sb_publishable or sb_secret keys? Legacy keys can stay on until you swap them. Don't send the new keys as a Bearer JWT.

   • Supabase
   • Lovable
   • Bolt
   • Cursor
   • Vercel
   • Netlify
   • Security

All platforms