Fix · Supabase and databases

My Supabase service key was exposed

UrgentSecurity

What you may see

I pasted the service role key into chat, GitHub or a public page
Someone warns that my database is open

Most likely cause

The service key has full access and ignores all security rules, so anyone with it can read, change or delete everything.

Check first (about two minutes)

Do you know where it was exposed (chat, repository, website code)?

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a careful senior engineer who knows Supabase (database, login and file storage) and explains it to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

THE PROBLEM
My Supabase service key was exposed

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
The service key has full access and ignores all security rules, so anyone with it can read, change or delete everything.

DO THESE STEPS, IN THIS ORDER
1. Tell me to rotate the key NOW in the project's API settings (create a new one, then disable the old; the page may be labelled differently).
2. Tell me which places must get the new key (host settings, local file, automation) and have me update them one by one.
3. Check the database for suspicious changes (new users, deleted rows, new policies) in the logs available to me.
4. Make sure the key is used only in server code from now on.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- The old key no longer works, the app works with the new one, and the logs show no strange activity.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not wait to "find out first" whether anyone used it. Rotate first.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Tell me to rotate the key NOW in the project's API settings (create a new one, then disable the old; the page may be labelled differently).
Tell me which places must get the new key (host settings, local file, automation) and have me update them one by one.
Check the database for suspicious changes (new users, deleted rows, new policies) in the logs available to me.
Make sure the key is used only in server code from now on.

Do not do this

Do not paste the new key into chat either.
Do not wait to "find out first" whether anyone used it. Rotate first.

Try another entry