willchen96 keeps the master key off the front door

The most powerful credential in the stack no longer has any business being near the browser.

securityinfrastructure

Mike runs on Supabase, the hosted database-and-login service that stores the app's data. Supabase issues a high-privilege "service-role" key that can bypass normal access rules - exactly the kind of credential that should live only on the backend and never touch the frontend. willchen96 pulled that key out of the frontend's setup instructions entirely, deleted an unused frontend helper that could reach it, and restated in plain terms that the key is backend-only.

He also made the backend fussier about it: if that credential is missing or blank, the app now fails loudly at startup instead of quietly wiring itself to nothing and breaking later in some hard-to-trace way.

So what Anyone weighing Mike for real client data should like this - it is basic credential hygiene done right, and it turns a silent misconfiguration into an obvious one.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

5 commits from open-legal-products/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`9749d601`	fix: enforce SUPABASE_URL and SUPABASE_SECRET_KEY presence in server-side client; remove unused supabase-server.ts file	willchen96	2026-05-16	↗ GitHub
`4ba4d53c`	Merge pull request #138 from willchen96/supabase-env-cleanup	cosimoastrada	2026-05-16	↗ GitHub
fix: enforce SUPABASE_URL and SUPABASE_SECRET_KEY presence in server-side client; remove unused supabase-server.ts file
`a8cf33ae`	Remove unused Supabase request auth helper	mahaprasad nanda	2026-06-19	↗ GitHub
`80d14b86`	test: drop mocks of removed getUserIdFromRequest helper	willchen96	2026-07-26	↗ GitHub
commit body The integration tests landed on main after this branch was cut and mocked the helper this PR deletes. Vitest factory mocks don't validate against the real module shape, so the extra key was harmless but misleading. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`416b32b1`	Merge pull request #186 from user-in-search-of-a-name/codex/remove-dead-supabase-auth-helper	Will Chen	2026-07-26	↗ GitHub
[codex] Remove unused Supabase request auth helper

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-708.md from inside the repo you want the changes in.

⬇ Download capture-thread-708.md