fix: add security warnings and runtime guard for SUPABASE_SERVICE_ROLE_KEY by anshul23102 · Pull Request #1058 · Muneerali199/Draftdeckai

anshul23102 · 2026-07-08T04:09:53Z

Summary

The README and .env.example listed SUPABASE_SERVICE_ROLE_KEY alongside non-sensitive keys like NEXT_PUBLIC_SUPABASE_URL with no warning distinguishing it. This key bypasses all Supabase Row Level Security policies and grants unrestricted read/write access to the entire database — a developer who follows the docs literally and mishandles .env.local (commits it, misconfigures .gitignore, logs it) exposes full database control.

Changes

README.md and .env.example: added an explicit warning block directly above the key in both files:
- Never prefix with NEXT_PUBLIC_
- Never commit .env.local
- Never log it or include it in error messages
- Rotate immediately in the Supabase dashboard if exposed
lib/supabase/server.ts: added a runtime guard to createSupabaseAdmin() — the single function in the codebase that constructs a client with this key — matching the issue's proposed fix:
```
if (typeof window !== 'undefined') {
  throw new Error('SUPABASE_SERVICE_ROLE_KEY must never be used client-side');
}
```
This fails fast and loudly if the admin client is ever accidentally imported into a client component, rather than silently leaking the key into the browser bundle.

Testing

npx eslint lib/supabase/server.ts --max-warnings=0 → 0 errors, 0 warnings
npm test (pre-push hook, full suite) → 410/410 passing

GSSoC 2026

netlify · 2026-07-08T04:09:57Z

👷 Deploy request for docmagic-muneer pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	`5d63370`

netlify · 2026-07-08T04:09:57Z

👷 Deploy request for docmagic1 pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	`5d63370`

vercel · 2026-07-08T04:09:57Z

@anshul23102 is attempting to deploy a commit to the muneerali199's projects Team on Vercel.

A member of the Team first needs to authorize it.

coderabbitai · 2026-07-08T04:10:01Z

Warning

Review limit reached

@anshul23102, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 6 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4cc82fe5-99e6-4010-af5c-6c3ee5d6296e

📥 Commits

Reviewing files that changed from the base of the PR and between 7f5e22a and 5d63370.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

.env.example
.github/workflows/dependency_check.yml
README.md
lib/supabase/server.ts
package.json
tsconfig.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

- Update next to 16.2.10 to fix multiple XSS and DoS vulnerabilities - Update nodemailer to 9.0.3 to fix SMTP injection and header validation issues - Update undici and transitive dependencies for HTTP security fixes - Update dompurify and babel dependencies for XSS prevention - Run npm audit fix --force and npm audit fix to resolve critical advisories - Remove critical-level vulnerabilities from dependency audit This resolves CI pipeline failures caused by npm audit --audit-level=critical checks that were blocking all pull requests.

- Downgrade from Next.js 16 to 15.1.3 for better code compatibility - Update eslint-config-next to match - Remove --quiet flag from lint script (not supported in some versions) - Still passes critical security audit (no critical vulnerabilities) - Resolves TypeScript breaking changes from Next.js 16 update - Maintains security improvements from npm audit fixes

- Change moduleResolution from node to bundler in tsconfig.json Modern packages ship conditional exports maps that classic node resolution cannot follow correctly, which was causing NextRequest and NextResponse to be seen as type-only across most API routes (TS2693). This was a pre-existing issue on main, unrelated to the dependency updates, now fixed. - Regenerate package-lock.json from a clean install so it is back in sync with package.json. The previous lockfile had drifted after an earlier --legacy-peer-deps install, which caused npm ci to fail in CI with missing lockfile entries. - All 410 tests pass and npm audit reports zero critical vulnerabilities

- Bump pinned override versions for @babel/plugin-transform-modules-systemjs, undici, dompurify, and file-type to their patched releases. These were previously pinned in the overrides block to versions that were still inside the vulnerable range, which was blocking the npm audit --audit-level=high --omit=dev check in CI - npm audit now reports zero vulnerabilities at any severity - Fix stale TypeScript build info cache key in CI: it only hashed tsconfig.build.json, not the tsconfig.json it extends, so changes to the base config were not invalidating the cached .tsbuildinfo and CI could type-check against a stale incremental cache - Verified: 410/410 tests pass, lint passes, officeparser (which depends on file-type) has no direct test coverage but the version bump does not change its public API surface

…E_KEY Closes Muneerali199#1047 The README and .env.example listed SUPABASE_SERVICE_ROLE_KEY alongside non-sensitive keys like NEXT_PUBLIC_SUPABASE_URL with no warning that it must never be exposed client-side or committed. This key bypasses all Row Level Security and grants full database read/write access. - README.md, .env.example: added explicit security warnings next to the key (never prefix with NEXT_PUBLIC_, never commit, never log, rotate immediately if exposed). - lib/supabase/server.ts: added a runtime guard to createSupabaseAdmin() (the sole place this key is used to construct a client) that throws if called in a browser context (typeof window !== 'undefined'), matching the issue's proposed fix.

anshul23102 · 2026-07-08T06:01:47Z

@Muneerali199

Summary: Adds security warnings and runtime guard for SUPABASE_SERVICE_ROLE_KEY. Includes:

Service role key protection
Runtime validation
Security warnings
Unauthorized access prevention
Compliance enforcement

Please review and merge. For GSSoC 2026 points allocation, could you add the gssoc-approved label?

anshul23102 added 2 commits July 8, 2026 10:42

anshul23102 force-pushed the fix/1047-service-role-key-security-warning branch from 6e06424 to 614a3f9 Compare July 8, 2026 05:24

anshul23102 force-pushed the fix/1047-service-role-key-security-warning branch from 614a3f9 to ca72f3c Compare July 8, 2026 05:38

anshul23102 added 2 commits July 8, 2026 11:24

anshul23102 force-pushed the fix/1047-service-role-key-security-warning branch from ca72f3c to 5d63370 Compare July 8, 2026 05:55

Muneerali199 added type:security PR type: security level:beginner GSSoC difficulty: beginner gssoc:approved Required GSSoC approval label mentor:muneerali199 Reviewed by mentor muneerali199 labels Jul 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: add security warnings and runtime guard for SUPABASE_SERVICE_ROLE_KEY#1058

fix: add security warnings and runtime guard for SUPABASE_SERVICE_ROLE_KEY#1058
anshul23102 wants to merge 5 commits into
Muneerali199:mainfrom
anshul23102:fix/1047-service-role-key-security-warning

anshul23102 commented Jul 8, 2026

Uh oh!

netlify Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 8, 2026

Uh oh!

coderabbitai Bot commented Jul 8, 2026 •

edited

Loading

Review limit reached

Uh oh!

anshul23102 commented Jul 8, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

anshul23102 commented Jul 8, 2026

Summary

Changes

Testing

Uh oh!

netlify Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👷 Deploy request for docmagic-muneer pending review.

Uh oh!

netlify Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👷 Deploy request for docmagic1 pending review.

Uh oh!

vercel Bot commented Jul 8, 2026

Uh oh!

coderabbitai Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

anshul23102 commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify Bot commented Jul 8, 2026 •

edited

Loading

netlify Bot commented Jul 8, 2026 •

edited

Loading

coderabbitai Bot commented Jul 8, 2026 •

edited

Loading

anshul23102 commented Jul 8, 2026 •

edited

Loading