Supabase Secret Scanner
Pricing
Pay per event
Supabase Secret Scanner
Scan a GitHub user or organization for committed Supabase service_role keys before someone else finds them. Decodes JWT payloads (ignores the public anon key), checks .env files, NEXT_PUBLIC_ leaks, MCP configs, and hardcoded keys in source. Built for pre-launch self-audits.
Pricing
Pay per event
Rating
0.0
(0)
Developer
Cenk KURTOĞLU
Maintained by CommunityActor stats
0
Bookmarked
1
Total users
0
Monthly active users
3 days ago
Last modified
Categories
Share
Supabase Secret Scanner (Apify Actor)
Scan a GitHub user or organization for committed Supabase service_role keys before someone else finds them.
What it checks
| Rule | Severity | What it means |
|---|---|---|
SERVICE_ROLE_JWT_LITERAL | critical | A service_role JWT is hardcoded in source. It bypasses every RLS policy. |
SERVICE_KEY_IN_ENV_FILE | high | A committed .env* file holds a service_role key. It lives in git history even after deletion. |
NEXT_PUBLIC_SERVICE_ROLE_NAME | critical | A NEXT_PUBLIC_ variable is named for the service role — it ships to every browser. |
NEXT_PUBLIC_JWT_NOT_ANON | critical | A NEXT_PUBLIC_ variable carries a non-anon Supabase JWT. |
The scanner decodes JWT payloads and only reports non-anon roles — the public anon/publishable key is never a finding.
Input
| Field | Required | Default | Notes |
|---|---|---|---|
githubTarget | yes | — | GitHub user or organization login |
targetType | no | user | user or org |
githubToken | yes | — | Your personal access token (read-only scope is enough) |
maxRepos | no | 30 | Stops after N repositories (sorted by last push) |
maxFilesPerRepo | no | 200 | Caps scanned files per repository |
includeForks | no | false | Include forked repositories |
Output
One dataset item per finding (repository, file, rule, severity, redacted evidence, fix hint), plus a _type: "summary" record with totals and a verdict.
Important limits
- Scans the default branch tree of public repositories. Git history and private repositories are not covered.
- The GitHub token you provide is used only for API rate limits and stays in your own Apify account.
- Evidence is redacted (first 6 characters + length). Nothing sensitive leaves the scan.
Fix (2 minutes, do it now if you got findings)
- Supabase Dashboard → Project Settings → API → rotate the service_role key.
- Move the new key to a runtime-only environment variable (server-side).
- Deleting the committed file is not enough — the key stays in git history until rotated.
