skills.rest
marvinbiss
marvinbissCOMMUNITY
Explore all skills by this author →
GitHub

supabase-extract-service-key

Detect exposed Supabase service_role keys in client-side code.

Updated Jan 31, 2026
Search Tags:#security#vulnerability#audit#supabase#data leak#service key
One-click install
npx skills add https://github.com/marvinbiss/servicesartisans --skill supabase-extract-service-key-marvinbiss
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supabase-extract-service-key
Source: https://github.com/marvinbiss/servicesartisans/tree/main/.cursor/skills/supabase-extract-service-key
Command: npx skills add https://github.com/marvinbiss/servicesartisans --skill supabase-extract-service-key-marvinbiss

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill prevents critical security breaches by detecting if the highly sensitive Supabase service_role key is accidentally exposed in client-side code, which bypasses all security policies.

Core Features & Use Cases

  • Critical Security Audit: Identifies the presence of the service_role key in client-side JavaScript bundles, inline scripts, or source maps.
  • Detailed Impact Analysis: Explains the severe consequences of exposure, including full database access, RLS bypass, and user impersonation.
  • Use Case: During a routine security audit of a web application using Supabase, this skill is run to ensure the service_role key is not present in any publicly accessible client-side code, preventing a P0 severity vulnerability.

Quick Start

Check for service key leaks on https://myapp.example.com.

Frequently Asked Questions about supabase-extract-service-key

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan for a leaked Supabase service_role key in client-side code?▼

Scanning for a leaked Supabase service_role key involves analyzing HTML source, JavaScript bundles, inline scripts, and source maps for specific patterns and JWT claims. This process detects accidental exposure that bypasses Row Level Security policies.

What happens if my Supabase service_role key is exposed in a JavaScript bundle?▼

Exposing your Supabase service_role key in a JavaScript bundle creates a critical P0 security vulnerability. Attackers can exploit this to gain full database access, bypass all Row Level Security policies, and impersonate users.

Why does an exposed service_role key bypass Row Level Security in Supabase?▼

An exposed service_role key bypasses Row Level Security because it is designed for privileged server-side operations. When included in client-side code, it grants full database access and allows malicious actors to override all configured RLS policies.

How do I remediate a Supabase service key leak and secure my application?▼

To remediate a Supabase service key leak, you must rotate the compromised service_role key immediately. Then, move all privileged operations to Supabase Edge Functions to ensure sensitive keys remain strictly server-side.

Can I detect Supabase service key leaks from source maps and inline scripts?▼

Yes, you can detect Supabase service key leaks from source maps and inline scripts. A thorough security audit scans these alongside HTML source and JavaScript bundles for specific JWT claims indicating the critical service_role key.

Related Skills

Explore More Software Engineering Skills→
yoanbernabeuyoanbernabeu
62

supabase-extract-service-key

Detect exposed Supabase service_role keys in client-side code.

Community
Advanced
xalgordxalgord
846

supabase

Detect misconfigurations and vulnerabilities in Supabase deployments.

Community
Advanced
opsMachineopsMachine
1

supabase-security

Apply Supabase security best practices for RLS policies, auth, and edge functions.

Official
Advanced
matteocervellimatteocervelli
25

security-scanner

Scan codebases for secrets, vulnerable dependencies, and insecure patterns.

Community
Advanced