The anon key is not the leak

A Supabase anon key in your JavaScript is normal. The browser needs it. It does not skip row level security.

Scan the URL you shipped before you send it to users.

What does leak is a service_role JWT, a Stripe secret, or an OpenAI key compiled into the same bundle. Anyone who can load the page can copy those. A NEXT_PUBLIC_ or VITE_ variable with secret, token, or password in the name is the same class of mistake.

A public .env file is worse, because it is the raw secrets, not a minified hint. Missing security headers are a smaller issue. They do not hand over a key by themselves.

The free scan reads only the public page and its scripts, then grades what a visitor can already see.

Paste the live URL and get the grade: free scan.