Audit: 20% of disclosed Supabase keys were still live

Security researcher Cenk Kurtoglu re-tested 30 previously disclosed Supabase service_role keys: 6 still returned HTTP 200 and granted full database access, 14 projects were paused, and only 12 keys had actually been rotated. Some developers claimed they had rotated the key while it remained active.

• 6 of 30 keys still granted database access via HTTP 200
• 12 keys were genuinely rotated after disclosure
• 14 projects paused, but keys revive if restored
• Rotating the JWT secret in Supabase takes about two minutes