The easiest planted hole to misread in our Supabase demo

We planted a few holes in a throwaway demo Supabase project to see how each one looks from the outside. The easiest one to misread was the secret key in the frontend. A long eyJ... string in your bundle looks alarming, but the public anon key looks exactly like that too. What matters is whether one decodes to "role":"service_role", or whether a newer key starts with sb_secret_ (sb_publishable_ is meant to be public).

How do you all check what your app actually ships to the browser?

For our launch, we're doing a free 15-minute look at Supabase database rules for the first 10 apps. Read-only, no keys needed. Comment here or email [e-mail] if you want one.