Sample

A Bolt app that shipped its server key.

Click a finding. Switch the platform. The keys are fake. Score 45, grade D.

Sample report

sample.invalid/

Grade D · out of 100

Secrets−40 / 40
Data accessNot in this scan
StorageNot in this scan
FunctionsNot in this scan
Headers and launch−15 / 15

Supabase service_role key in the client bundle

The JavaScript sent to the browser contains a Supabase service_role key (prefix eyJhbGci). Seen at https://sample.invalid/assets/index-B2k.js. That key bypasses Row Level Security.

service_role is a server secret. In a bundle it is public, in the same way a database password printed in the HTML is public. Rotate it before you do anything else.

Key type: supabase_service_role
Prefix: eyJhbGci
Where: https://sample.invalid/assets/index-B2k.js

Fix prompt · Bolt

In Bolt, paste this into the chat:

The client bundle contains a Supabase service_role key (prefix eyJhbGci). Remove it from every client component and from any env var that is inlined into the browser (VITE_, NEXT_PUBLIC_, PUBLIC_). Rotate the key in the Supabase dashboard under Project Settings → API. The browser may use only the anon key. Keep service_role on the server. Search the repo for service_role and SUPABASE_SERVICE_ROLE.

This is a sample Bolt app, not a live site. It is 45 out of 100. The heaviest finding is: Supabase service_role key in the client bundle. The scan did not call Supabase. A high score does not mean Row Level Security holds — that is the two-account test.

Sample data. The keys are fake and the host does not exist.
This scan did not call Supabase, Auth, Storage, or GraphQL.
Row Level Security was not tested. That is the two-account Live Test.