Scan finds working service_role key in git for 58 of 154 public Supabase apps

A scan of 154 public Supabase apps found that 58 shipped a working service_role key in their git history. The key bypasses Row-Level Security entirely, allowing anyone who finds it to run DELETE FROM "user" over the REST API.

• 58 of 154 public Supabase apps had a working service_role key in git
• The service_role key bypasses RLS and allows DELETE FROM "user" via REST API
• Causes: AI tools commit .env with real keys and files named like .env.txt
• Deleting .env in a new commit does not help — the key stays in git history