Fix guide · critical · supabase_service_role_jwt_pattern
Supabase personal access token (sbp_*) in client code
What this rule means
An sbp_* token was found in your client. This is Supabase's personal access token format for the Management API.
Why it matters
Personal access tokens grant account-level admin access via Supabase's Management API: list and modify projects, rotate keys, change billing, delete data. Different from anon/service_role JWTs (which are project-scoped).
How to fix it
- Revoke the token at supabase.com/dashboard/account/tokens.
- Move all Management API calls server-side. PATs should never appear in browser code.
- For per-project programmatic access, use the project's API key (anon or service_role) instead of an account-level PAT.
Did vibecheck flag this on your app?
If you reached this page from a vibecheck inspection report, the redacted match in your scan output is the exact string we found in your bundle. After applying the fix above, run the inspection again — the finding should clear.
Run another inspection