supabase/service-role-key
Checks that only edge functions and test files name a secret or service role key.
Part of the supabase configuration, at the recommended level. It runs at the commit stage, once per scope. gspot runs this check itself.
Secret and service role keys bypass row level security, so a client bundle that holds either exposes privileged database access.
What to do
Section titled “What to do”Move code to edge functions or tests, or run gspot ignore supabase/service-role-key with a reason.
Example
Section titled “Example”Client code that reads a Supabase service-role key reports a finding. Move the key and the privileged work into an edge function.
Turn it off
Section titled “Turn it off”Turn it off for some files, with a reason:
gspot ignore supabase/service-role-key --paths "<glob>" --reason "<why>"