School · Module 2 · Lesson 2 of 4
Keep the service_role key on the server
service_role and sb_secret_ keys bypass RLS. They must never ship to the browser.
The Supabase service_role key ignores RLS. Use it only in trusted server environments for admin tasks, and prefer a restricted key when you can.
Never put service_role in NEXT_PUBLIC_, VITE_, mobile apps or edge middleware that runs in the user's browser context.
If one leaked, rotate it in the Supabase dashboard, redeploy, and audit table access while you wait for the old key to die.