Supabase service_role key in client

Why it matters

The service_role key bypasses every Row Level Security rule. Anyone holding it can read, change or delete your whole database.

How to fix it

Rotate the service_role key in Supabase now, remove it from client code, and use the anon key in the browser.

How we test it

Passive — runs in the free check, looks only at what a browser can see.