Severity: high
Type: secret-exposure · Scanner: config-drift
Finding: service_role key referenced in a public API route
Location(s):
app/api/feedback/route.ts:29 (fp c1acfbe94a80cf8a)
Recommended fix: The Supabase service_role key bypasses RLS. It must never be reachable from a public route or the client. Move it behind a server-only boundary and rotate if it shipped.
Raised by Aegis (aios/security). Secret values are redacted; this issue references only locations.
Severity: high
Type: secret-exposure · Scanner: config-drift
Finding: service_role key referenced in a public API route
Location(s):
app/api/feedback/route.ts:29(fpc1acfbe94a80cf8a)Recommended fix: The Supabase service_role key bypasses RLS. It must never be reachable from a public route or the client. Move it behind a server-only boundary and rotate if it shipped.
Raised by Aegis (aios/security). Secret values are redacted; this issue references only locations.