Fix a Supabase `service_role` key in your code

Rule: `secret/supabase-service-role` (critical)

What muster-check saw

A JWT whose decoded payload says `"role": "service_role"`. The tool decodes the token; it does not guess from the name. An `anon` key is public by design and is not flagged. Title changes with location: "shipped to the browser" if the file is client-reachable, otherwise "committed to source".

Why it matters

Anyone holding it reads and writes every table, ignoring all RLS policies you wrote.

Fix

1. Rotate the JWT secret / keys in the Supabase dashboard (new keys invalidate the old ones).
2. Use the `anon` key in browser code; use `service_role` only in server routes, edge functions or jobs, read from a server-only env var.
3. Make sure the variable has no `NEXT_PUBLIC_`/`VITE_` prefix (see the public env prefix guide).

Prove it's fixed

Against your own project: with the old service_role key, request `GET <project-url>/rest/v1/<table>?select=*` with `apikey` and `Authorization: Bearer <old key>`; expect 401 after rotation. Then repeat with only the anon key on a table that should be private; expect an empty result or 401/403.