Is my Supabase anon key exposed?

The anon key is a public client key. Supabase expects it in your frontend, next to the project URL. It does not bypass row level security. Seeing it in the page source is not, by itself, a leak.

The key that must not ship is the service_role JWT. It is a secret. Anyone who has it can read and write tables as an admin, ignoring RLS. If a scan finds that JWT in a bundle, rotate it in the Supabase dashboard and remove it from client code.

A NEXT_PUBLIC_ or VITE_ variable is also public. Do not put a service role, Stripe secret, or OpenAI key in one.

How to check:

• Open the live site, view source, and search for eyJ (the start of a JWT) and for service_role.
• Or paste the URL into the scan below. VibeSafe fetches the HTML and same-origin scripts with GET, then flags a service_role JWT if it is in the bundle.
• The scan also sends the anon key in a read-only GET of common table names with limit=1. A returned row means that table is readable without a logged-in user. An empty response is inconclusive: RLS may be on, or the table may have no rows. Row values are not stored.

This is not a penetration test. It does not log in, fuzz routes, or write data. Only scan sites you own or are authorized to test.