Security: two secrets are published to the browser via build config — please rotate (details available privately)

**This report has been redacted.**

The original text named the exact file and variables involved. That was the wrong call for a live deployment: it pointed anyone reading this issue straight at an exploitable credential before the maintainer had a chance to rotate it. Redacting here rather than leaving it up.

**What you need to know:** two secrets are being published to the browser through your build configuration. One of them is a signing secret, which is the more serious of the two — anyone holding it can mint valid tokens with any role they choose.

**What to do, in this order:**

1. Rotate both secrets in the Supabase dashboard now. Removing them from the repo without rotating changes nothing, because the values remain in git history.
2. Then review which variables your build config publishes to the client. Only values that are safe for every visitor to read belong there.

I did not touch your database. I only read your public source code, and I never used either value.

The specific file, line numbers and a patch are yours on request — I will send them privately to whatever address you prefer. There is no charge and nothing is being sold here.

Cenk

The report names no public file, variables, tests, or entry point because the details were redacted. Start in the Supabase dashboard, then review the build configuration to identify client-published variables; done means both secrets are rotated and only values safe for every visitor remain exposed.

Written by the indexing model from the issue text.