Ship It Checklist

Checklists /Lovable + Supabase /Security

Critical

Keep the service role key off the client

The service role key bypasses row level security. If it is bundled into the Lovable app, anyone can extract it from the browser and read the database. The anon key is the only Supabase key that belongs in frontend code.

How to check

  1. In Supabase, open Project Settings and then API. Note which key is labelled service_role. Do not paste it into the app.
  2. In Lovable, open the project secrets or environment settings. The service role value must not be referenced from files that run in the browser.
  3. Publish or export the frontend and search the built JavaScript for the service role key prefix, or for the words service_role.
  4. Browser code should create the Supabase client with the anon key only.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: the Supabase service role key must never be shipped to the browser. The browser client must use the anon key only.

Steps:
1. Search the repo for service_role, SERVICE_ROLE, and any key that is not the anon key.
2. If server-side code genuinely needs the service role key, read it from an environment variable that is not prefixed for the client (no VITE_ prefix).
3. Remove the service role key from every file that is imported by the UI.
4. If you find the real key in the repo, replace it with an environment variable and tell me to rotate the key in Supabase. Do not print the key.
5. Summarise the files you changed.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes