PatchVault › Errors › Vibe-coded app security

NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY

A Supabase service_role (or sb_secret_) key is read through a NEXT_PUBLIC_ variable. Next.js inlines every NEXT_PUBLIC_ value into the JavaScript sent to the browser at build time, so anyone can read it in DevTools.

Check your code free (runs in your browser)

The box is pre-filled with a sample that triggers this error. Paste your own file to check it. Nothing leaves this page.

Or scan your whole repo locally (free, stdlib Python, read-only):

python3 <(curl -fsSL https://patchvault-81y.pages.dev/starters/vibe-security-scan.py) .

Why it happens

Supabase secret and service_role keys bypass every Row Level Security policy. Supabase's docs say a secret key must never go in a browser, source control or a shipped bundle.

Manual fix

1. Rotate the key in Supabase: Project Settings > API keys.
2. Rename the variable without the prefix: SUPABASE_SECRET_KEY=...
3. Use it only in server code (route handler, server action, Edge Function).
4. In the browser use only the publishable/anon key, and keep RLS on.

Verify

Re-run your install/build and re-scan the file above. The finding should be gone. The paid fixer applies the same change across a repo: --dry-run shows the diff, --apply keeps a .bak of each file, and --rollback restores them.

Sources

• Next.js docs: bundling environment variables for the browser
• Supabase docs: API keys

Related errors

• GH013: Push cannot contain secrets: fix
• Supabase "new row violates row-level security policy"
• Supabase rls_disabled_in_public: table publicly accessible
• Stripe sk_live_ key hard-coded in source: rotate and move it
• CORS: Access-Control-Allow-Origin '*' with credentials fails (and why * is risky)

Full guide and free terminal scanner: Vibe-coded app security fix bundle. Last checked 2026-10-31.