TL;DR

This morning I ran a wider sweep of public GitHub repos that import @supabase/supabase-js and have anything resembling an anon key (or worse, a service_role key) in committed code.

Out of ~30 repos I probed (responsibly — counts only, no row contents), three had production-grade leaks :

A Chinese AI paper-writing tool with 1,669 stars and 1,843 user profile records readable anonymously.

Two indie-SaaS repos with the service_role key committed to .env.local — meaning anyone who finds the repo can read/write/delete every row in their database.

All three got responsible-disclosure pings (private email or GitHub issue) with a free DIY fix walkthrough + a paid turnkey option. We'll see what happens.

This post is about the method + monetization frame , not naming specific projects. If you want to scan your own project, the CLI is open source: @perufitlife/supabase-security .

The method (90 seconds per repo)

# 1.…