Supabase Key Exposure Check (Free, Offline)

    1

    Free offline check that finds Supabase service_role / sb_secret_ keys leaking into browser code, public env vars, bundles or committed files.

    Free

    1 installSecurity scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    About this skill

    Use before launching a Supabase app, or when you suspect a key leaked. Scans a repo or build folder (dist, .next, build), decodes legacy JWT keys offline to read the role claim (anon vs service_role), recognises sb_publishable_ and sb_secret_ keys, and returns a PASS/FAIL verdict with file:line evidence and redacted values.\n\nFlags a secret key that reaches: a public-prefixed env var (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_), a browser bundle, a use-client file, or a committed env file. Tells you to rotate and how.\n\nFree, offline, read-only. Standard-library Python 3.8+, no network, no account. Never prints a full key. A PASS covers these patterns only and is not a full secret scan; git history is not searched.\n\nThe anon key is public by design, so RLS is your only wall: the paid Supabase RLS Launch Gate checks that next.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    1 install

    Downloaded by developers to date

    Free forever

    No account required to browse

    Trust & safety

    Security scanned

    Verified clean 4 days ago

    • Free to download with an account

    Requires

    Python

    Listed4 days ago

    What's inside

    Frequently Asked Questions

    Free