---
description: 'When a React/Vite SPA is built, secrets and internal API structure baked
  into the JavaScript bundle become trivially extractable. Key mitigations: runtime
  config injection (env vars resolved at deploy time, not build time), short-lived
  keys, and RLS as last-line defense.'
kind: observation
name: supabase-spa-bundle-exposure
---


# Supabase SPA Bundle Exposure Pattern

Secrets and internal API structure hardcoded into a React/Vite build are trivially extractable from the JavaScript bundle — even a minified, 877 KB file.

## What leaks through bundle analysis alone

- **Auth keys** — Supabase anon key recoverable in plaintext; JWT expiry is attacker-visible (36-year expiry observed in the wild).
- **Internal API tree** — full Kong gateway route hierarchy, webhook paths, and subdomain structure.
- **Tech-stack fingerprint** — framework, gateway vendor, database provider, and CDN all identifiable without authenticated access.

## Risk profile

The anon key is *designed* to be public, but hardcoding it creates compounding exposure:
- enables brute-force and DoS amplification against discovered endpoints
- locks in a long-lived credential that is hard to rotate across deployed builds
- gives attackers a pre-built map to probe for future RLS misconfigurations

## Key mitigations

1. **Runtime config injection** — resolve credentials via env vars at deploy time, not at `vite build` time; the bundle then contains no secrets.
2. **Short-lived keys** — cap anon key expiry at one year or less; rotate on cadence.
3. **RLS as last-line defense** — active Row Level Security meaningfully reduces blast radius even when the anon key is fully exposed; empty-array returns to unauthenticated queries are the intended behavior, not a coincidence.

## Precedent (SumoPod audit, 2026-07-26)

RLS being active reduced immediate risk from CRITICAL to medium despite key exposure — a concrete instance of defense-in-depth limiting a credential leak to low immediate data-loss impact.

---

derived_from:: [[memory/2026-07-26/sumopod-security-audit-findings.md]]
derived_from:: [[memory/2026-07-26.md]]