Which of your settings are public?

One prefix decides whether a key stays on your server or ships to every visitor. Paste your .env and see, variable by variable, before you deploy.

  • NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_ and REACT_APP_
  • Catches secret keys by name and by value
  • Runs in your browser, values masked

Checked in your browser: nothing is sent or stored, and values are shown masked. Prefer not to paste values? Names alone (NAME=) still show what reaches the browser.

How a prefix makes a key public

Frameworks copy some settings into the JavaScript every visitor downloads, so the page can use them: Next.js copies anything starting with NEXT_PUBLIC_, Vite anything starting with VITE_, Expo EXPO_PUBLIC_. Everything else stays on the server.

That is right for your Supabase URL and anon key, and wrong for anything secret. AI tools often add the prefix to a secret key because the browser could not read it; the error goes away, and the key is now public.

If a secret is exposed

  1. Revoke the key in the provider's dashboard and create a new one: it may already be copied.
  2. Rename the variable without the public prefix.
  3. Move the code that uses it to a server route or function.
  4. Deploy, then scan your live site to confirm the key is gone.

Questions

Is it safe to paste my .env here?
The check runs entirely in your browser: nothing is sent to us or stored, and values are shown masked. If you would rather not paste values, paste only the names (NAME=); the public-or-not check still works.
Is the Supabase anon key safe to make public?
Yes, it is designed to be public, as long as every table has Row Level Security. The service role (or secret) key must never have a public prefix.
Does this check my live site?
No, it checks the file you paste. To see what your live site actually ships, use the exposed API key scanner.