Service-role key shipped in the browser bundle
- Tried
- Connect Supabase from a vibe-coded frontend so auth and queries “just work”
- Broke
- service_role / sk_live ended up client-side (or NEXT_PUBLIC_); anon visitors could pull names and emails
- Fix
- F12 search for service_role and sk_live; move secrets server-only; rotate anything that was public