critical
supabase-jwt· SupabaseSupabase JWT
Full read and write access to every table, bypassing Row Level Security.
How it is detected
Matches any three-segment JWT, then decodes the payload — without verifying the signature, because the question is what the token claims to be, not whether it is valid. A `role` claim of `service_role` is critical; `anon` and `authenticated` belong in a browser and are reported as informational. A token issued by `supabase-demo` is the local development default that `supabase start` generates identically on every machine, so it is not treated as a leak.
If you find one
- 1Rotate the key in Project Settings → API. The old one stops working immediately.
- 2Move whatever needed it into an Edge Function or a server route, and keep only the anon key in the browser.
- 3Check Row Level Security is enabled on every table — a leaked service_role key bypasses it, so RLS is what limits the damage from the next one.
Where it turns up
Most often in Lovable and Bolt apps that need to bypass Row Level Security for an admin screen.