Security1 hOctober 21, 2026, 06:58

Live Supabase keys found committed in public MCP configs on GitHub

A developer scanned GitHub and found 12 .mcp.json files containing real Supabase service_role keys, with 4 projects still live. Such a key bypasses all row-level security and grants full database access. The author released free zero-dependency auditors for MCP configs.

DEV Community

Open source

Live Supabase keys found committed in public MCP configs on GitHub

53 of 65 candidate files were placeholders; 12 held real keys
4 projects with leaked keys are live right now
A service_role key bypasses RLS and grants full database access
Deleting the file doesn't help: the key stays in git history

#GitHub#Supabase#Claude#Cursor

18.8% of public Supabase repos left a table readable by the anon key

Security

Scan finds working service_role key in git for 58 of 154 public Supabase apps

Security

UpGuard: 16,326 Supabase Databases Were Publicly Readable Due to Disabled RLS

Security

Live Supabase keys found committed in public MCP configs on GitHub

18.8% of public Supabase repos left a table readable by the anon key

Scan finds working service_role key in git for 58 of 154 public Supabase apps

UpGuard: 16,326 Supabase Databases Were Publicly Readable Due to Disabled RLS

UpGuard: 16,000 Supabase databases publicly expose user data