← Back to report

Investigate Supabase anon key (public client key)

Build 5.0.7 · Scan 2026-10-09T21:45:41.530Z

2 distinct recorded findings; 2 have inspectable metadata. Locations are representative, not an inventory of every source match.

A Supabase anon (public) key. This key is meant to ship in clients, so its presence is expected — it is only an exposure if your tables' Row-Level Security is off, which is exactly what our live check tests. Marked low unless verified.

Static evidence does not establish runtime impact. Source excerpts and line numbers were not recorded.

Evidence preview

Evidence type

Static string match

Representative location

assets/index.android.bundle

Recorded match

Pattern recorded; identifying value redacted.

Detector rule

supabase

Recorded file locations

• assets/index.android.bundle