Supabase gives every project a public key, called the anon key and now also labeled the publishable key. It is meant to sit in your frontend code, so anyone who opens the browser's developer tools can copy it. That is by design, not a leak.
The danger is the assumption that a public key is harmless. The anon key is your app's identity when a stranger calls your database directly, and the only thing standing between that stranger and your tables is Row Level Security. AI coding tools often create tables without turning RLS on, or turn it on with a policy that allows everything. In both cases the anon key becomes a way to read or change every row.
So treat the key as public and the policies as the real lock. Confirm RLS is enabled on every table in an exposed schema, write policies that tie rows to the signed-in user, and never paste the service role key where the anon key belongs, because that one skips all policies.
import { createClient } from "@supabase/supabase-js";
export const supabase = createClient(
import.meta.env.VITE_SUPABASE_URL,
import.meta.env.VITE_SUPABASE_ANON_KEY
);