The Supabase anon key is a public key meant to ship to the browser; it respects Row Level Security, so it can only do what your policies allow. The service_role key bypasses RLS entirely and has full admin access, so it must only ever be used server-side and must never appear in client code or a public repo.
The anon (publishable) key
Safe to expose, by design. It identifies your project and carries the authenticated user's permissions. Its safety depends entirely on RLS being configured, because without policies it can read and write everything.
The service_role (secret) key
Never safe to expose. It skips all RLS and can do anything in your database. It belongs only in server code, edge functions, or route handlers, read from an environment variable, never in a client component or prefixed for the browser.
What this means for AI-generated code
AI tools sometimes reach for the service_role key to make an operation work without configuring RLS, and then place it in client-reachable code. If that key ends up in a browser bundle or a public repo, anyone can take full control of your database. Rotate it immediately if it was ever exposed.