# supabase/service-role-key

> Checks that only edge functions and test files name a secret or service role key.

Checks that only edge functions and test files name a secret or service role key.

Part of the [`supabase`](/reference/configurations/supabase/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once per scope. gspot runs this check itself.

## Why

Secret and service role keys bypass row level security, so a client bundle that holds either exposes privileged database access.

## What to do

Move code to edge functions or tests, or run `gspot ignore supabase/service-role-key` with a reason.

## Example

Client code that reads a Supabase service-role key reports a finding. Move the key and the privileged work into an edge function.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore supabase/service-role-key --paths "<glob>" --reason "<why>"
```