Is your Supabase service key exposed?

$ npx airlock-rls --site https://your-app.com

✗ 1 problem(s):
    ✗ https://your-app.com/app.js  Supabase service key exposed in the
      browser — it bypasses ALL Row Level Security. Rotate it now.

RLS audit failed: 1 problem(s) found.  (exit 1)

On a clean site it stays quiet:

$ npx airlock-rls --site https://your-app.com
✓ No problems.  RLS audit passed.  (exit 0)

Why a leaked service key is the worst case

• Your app ships two Supabase keys. The anon key is public by design — that one is fine in the browser.
• The service_role key is the master key. It runs past RLS entirely, so it reads and writes every row of every table.
• Vibe-coded and rushed apps leak it constantly — pasted into a client component, an env var prefixed for the browser, or bundled into the JS.

What the scan does

• Fetches your live page and the JavaScript it loads, and looks for a service_role JWT or a new-format sb_secret_… key.
• Never flags the anon key — it decodes each token and only fires on the real master key. No crying wolf.
• Never prints the key it finds — a security tool must not echo the secret.
• Exits 1 when it finds one, so you can drop it straight into CI.

Open source, and it proves what it claims

Airlock is MIT-licensed and tested. The same engine also runs the full RLS audit — disabled RLS, permissive policies, public storage buckets, and functions that bypass RLS — and can prove a leak by reading your tables with the anon key.