Supabase

Keys committed to GitHub in Supabase

Create a new secret key, switch the server to it, then revoke the leaked key and the legacy service role key if that was what got committed. Supabase's rotation note says to fix the cause before you rotate, and to confirm every component uses the new key before you retire the old one.

Fix for Supabase

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.