Supabase service_role key can silently leak into browser bundles in Next.js apps

The Supabase service_role key is an admin-level credential that bypasses Row Level Security entirely, making its exposure far more dangerous than a misconfigured RLS policy. In Next.js, prefixing the variable with NEXT_PUBLIC_ instructs the framework to embed its value directly into the client-side bundle at build time, exposing it to anyone with browser dev tools. Even without that prefix, the key can leak if a Server Component passes it as a prop to a client component, since Next.js serializes it into the RSC flight response sent to the browser. Other common exposure paths include debug API routes that return all environment variables and hardcoded key literals in modules imported by client-side code. Developers can audit for leaks by grepping the .next/static build output for JWT-shaped strings and by inspecting live HTTP responses from routes that render client components.