Supabase vs Firebase: Which Keys Are Public?
Updated 2026-10-17
Public client keys are normal in BaaS apps. Server credentials are not. This comparison describes common default patterns and where security responsibility sits. Platforms change quickly; verify current behaviour in each vendor's documentation.
| Credential | Public? | Notes |
|---|---|---|
| Supabase anon / sb_publishable_ | Yes | Protected by RLS |
| Supabase service_role / sb_secret_ | No | Bypasses RLS |
| Supabase DB connection string | No | Direct Postgres access |
| Firebase web apiKey | Yes | Protected by Security Rules / App Check |
| Firebase service account JSON | No | Admin SDK access |
Rule of thumb
If a credential is used by an admin SDK or bypasses user-level rules, it is secret.
FAQ
Does ShipGuard flag Firebase apiKeys?
No — they are public by design. It flags server credentials and Supabase service-role keys.
Check your deployed app in ~25 seconds
Free passive scan: leaked keys, Supabase exposure, public config files and headers.
Run a free scan