willchen96 keeps the master key off the front door

The most powerful credential in the stack no longer has any business being near the browser.

securityinfrastructure

Mike runs on Supabase, the hosted database-and-login service that stores the app's data. Supabase issues a high-privilege "service-role" key that can bypass normal access rules - exactly the kind of credential that should live only on the backend and never touch the frontend. willchen96 pulled that key out of the frontend's setup instructions entirely, deleted an unused frontend helper that could reach it, and restated in plain terms that the key is backend-only.

He also made the backend fussier about it: if that credential is missing or blank, the app now fails loudly at startup instead of quietly wiring itself to nothing and breaking later in some hard-to-trace way.

So what Anyone weighing Mike for real client data should like this - it is basic credential hygiene done right, and it turns a silent misconfiguration into an obvious one.

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from Open-Legal-Products/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`9749d601`	fix: enforce SUPABASE_URL and SUPABASE_SECRET_KEY presence in server-side client; remove unused supabase-server.ts file	willchen96	2026-05-16	↗ GitHub

SHA

Subject

Author

Date

9749d601

fix: enforce SUPABASE_URL and SUPABASE_SECRET_KEY presence in server-side client; remove unused supabase-server.ts file

willchen96

2026-05-16

↗ GitHub

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-708.md from inside the repo you want the changes in.