Supabase projects come with two main keys. The public one is limited by your security policies. The service role key, now also called the secret key, runs as a database role that skips those policies completely, so whoever holds it owns your data.
The usual failure is convenience. An AI tool hits a permissions error, and the quick fix it suggests is to swap in the service role key so the query works. If that code runs in the browser, or the key is stored in a variable that your build tool exposes to the client, the key is now public. Anyone can copy it and download or wipe every table.
Keep the key in server-side code only, such as an API route or a backend function, and load it from a server environment variable that is never exposed to the client. If it ever appeared in frontend code, a repo, a chat or a screenshot, rotate it in the Supabase dashboard right away and redeploy.
import { createClient } from "@supabase/supabase-js";
export const admin = createClient(
process.env.SUPABASE_URL!,
process.env.SUPABASE_SERVICE_ROLE_KEY!
);