On October 30, 2026, Supabase stops auto-exposing new public tables on existing projects. Your next migration may return 42501. Here's the safe fix, and the two tempting fixes that leak data.
If your vibe-coded app talks to Supabase from the browser, Row Level Security is the difference between “users see their own data” and “anyone with the anon key reads the whole table.”
One of the most common bugs in AI-built paid apps: the success page grants access. Anyone who types the URL gets the product free. The fix is a few lines of server code.
Short answer: the anon key being visible is normal. Whether that's a problem depends entirely on your Row Level Security. The service_role key is a different story.
How to find secret keys shipped in your JavaScript bundle, and what to do when you find one.