Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing touches🧪 Generate unit tests (beta)
Tip Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
simantak-dabhade
left a comment
There was a problem hiding this comment.
🔶 Security: committed Supabase credentials — please rotate and scrub
This PR commits synapse-main/.env with Supabase project credentials:
VITE_SUPABASE_PROJECT_ID="hclfbztkexgknfgbgtbi"
VITE_SUPABASE_PUBLISHABLE_KEY="eyJhbGci...NKI2hY"
VITE_SUPABASE_URL="https://hclfbztkexgknfgbgtbi.supabase.co"
The VITE_* prefix means these are intended to be bundled into client code, and the key's decoded role is anon — so this is a Supabase anon (public) key, not the service-role key. That makes it much less catastrophic than a raw service-role leak, but it's still a problem to have it committed to a public repo:
- Your Supabase project URL and anon key together identify a real project tied to your organization.
- Anon keys rely on Row Level Security being correctly configured. If RLS has gaps on any table, any reader of this repo can hit those tables directly.
- Rate limits, usage quotas, and billing are tied to that project.
Please do the following:
- Rotate the anon key in your Supabase dashboard (Project Settings → API → roll the anon key). Also check RLS on every table in this project.
- Delete
synapse-main/.envfrom this PR branch. - Add
synapse-main/.gitignorecovering.env,.env.local,.env.*.local,node_modules/,.next/,dist/. - Force-push to rewrite history so the credentials are not in the branch log.
- Add a
synapse-main/.env.examplewith just variable names and placeholder values (no real values) so future contributors know what to fill in.
Reopening for a full review once the credentials are rotated and scrubbed from branch history.
Context: we're currently tightening up secret hygiene across the cookbook after another contributor leaked a TinyFish API key in a similar way. A repo-level .gitignore is being added to prevent this class of issue going forward.
Synapse gives your AI agents hands. It's a developer platform for defining, testing, monitoring, and managing web automation actions powered by the TinyFish execution engine.
Try Here