Service Key Exposure

Service key exposure occurs when admin-level credentials (like Supabase service_role or Firebase admin SDK) are included in frontend code, giving attackers full database access.

Scan for This Vulnerability

What is Service Key Exposure?

Service keys bypass all security rules. The Supabase service_role key ignores RLS, and Firebase admin SDK credentials have unrestricted access. When these appear in frontend code, attackers gain complete control over your database regardless of your security configuration.

How It Happens

Using service key instead of anon key in frontend
AI suggesting service keys for convenience
Copy-pasting server code to frontend
Not understanding the difference between key types

Impact

Complete database access - bypasses all security

Can read, modify, or delete any data

Create/delete users and authentication

Full administrative control over your backend

How to Detect

Search code for 'service_role' or 'serviceRole'
Check for Firebase admin SDK in frontend
Look for keys that are much longer than anon keys
Run VAS to detect service key exposure

How to Fix

Remove service key from frontend immediately

Service keys should never be in client-accessible code.

Use anon key for frontend

Supabase anon key is safe for frontend use with proper RLS.

// Frontend - use anon key
const supabase = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL,
  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY // Safe for frontend
);

Keep service key server-side only

Use service key only in API routes, Edge Functions, or backend.

// Server-side only
const supabaseAdmin = createClient(
  process.env.SUPABASE_URL,
  process.env.SUPABASE_SERVICE_ROLE_KEY // Never expose this
);

Rotate compromised keys

If exposed, generate new keys in your Supabase/Firebase dashboard.

Commonly Affected Platforms

Lovable Security Bolt Security Supabase Security Firebase Security Replit Security

Is Your App Vulnerable?

VAS automatically scans for service key exposure and provides detailed remediation guidance.

Run Security Scan

Related Vulnerabilities

Api Key Exposure Rls Misconfiguration