Supabase Extract Service Key
This is a security check that scans your client-side code for accidentally exposed Supabase service_role keys, which bypass all Row Level Security and grant full database access. It decodes JWTs to check for the service_role claim, searches for common variable names like SUPABASE_SERVICE_KEY, and analyzes JavaScript bundles and source maps. If it finds an exposed key, you get immediate remediation steps: rotate the key in your Supabase dashboard, remove it from client code, and move privileged operations to Edge Functions. Run this before every production deployment. The difference between service_role and anon keys is the difference between a master key and a public API token, so this is genuinely a P0 finding if caught.
- skills.sh installs
- 500
- GitHub stars
- 75
- last updated
- Aug 21, 2026
Install
$ npx -y skills add yoanbernabeu/supabase-pentest-skills --skill supabase-extract-service-key --agent claude-codeInstalls into .claude/skills of the current project.
Files
Supabase Service Key Detection
🔴 CRITICAL: PROGRESSIVE FILE UPDATES REQUIRED
You MUST write to context files AS YOU GO, not just at the end.
- Write to
.sb-pentest-context.jsonIMMEDIATELY after each discovery- Log to
.sb-pentest-audit.logBEFORE and AFTER each action- DO NOT wait until the skill completes to update files
- If the skill crashes or is interrupted, all prior findings must already be saved
This is not optional. Failure to write progressively is a critical error.
This skill detects if the service_role key (admin key) is accidentally exposed in client-side code.
When to Use This Skill
- As part of every security audit (this is critical)
- When reviewing code before production deployment
- After detecting Supabase usage to check for this common mistake
Prerequisites
- Target application accessible
- Supabase detection completed (auto-invokes if needed)
Why This Is Critical
The service_role key bypasses ALL Row Level Security (RLS) policies. If exposed:
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/yoanbernabeu/supabase-pentest-skills
- Categories
- Backend & APIs, Security, Git & Pull Requests, Databases
- First seen
- Jun 3, 2026
More from yoanbernabeu/supabase-pentest-skills
All 23- Supabase Extract Db String499
- Supabase Audit Buckets List498
- Supabase Audit Buckets Read497
- Supabase Audit Auth Signup495
- Supabase Report Compare491
- Supabase Extract Jwt487
- Supabase Extract Url487
- Supabase Audit Authenticated446
- Supabase Audit Rls1.2K
- Supabase Audit Functions1.1K
- Supabase Pentest725
- Supabase Audit Auth Config576
- Supabase Audit Rpc551
- Supabase Audit Realtime544
- Supabase Help525
- Supabase Report516
- Supabase Audit Tables Read511
- Supabase Audit Buckets Public509
- Supabase Audit Auth Users506
- Supabase Audit Tables List504
- Supabase Extract Anon Key501
- Supabase Detect500
Recommended
More Backend & APIs
database-performance-debuggingaj-geddes/useful-ai-promptsDebug database performance issues through query analysis, index optimization, and execution plan review. Identify and fix slow queries.499skills.sh installs
api-documentation-generatordavila7/claude-code-templatesGenerate comprehensive, developer-friendly API documentation from code, including endpoints, parameters, examples, and best practices493skills.sh installs
supabase-extract-urlyoanbernabeu/supabase-pentest-skillsExtract the Supabase project URL from client-side JavaScript code, environment variables, and configuration files.487skills.sh installsapi-versioning-strategyaj-geddes/useful-ai-promptsImplement API versioning strategies including URL versioning, header versioning, backward compatibility, deprecation strategies, and migration guides. Use when 472skills.sh installs
api-error-handlingsecondsky/claude-skillsImplements standardized API error responses with proper status codes, logging, and user-friendly messages. Use when building production APIs, implementing error455skills.sh installs