No material or high-risk concern was identified in this review.
This advisory report describes what the named tools and contextual reviewer found at one exact commit. Unknown or unobserved behavior may still exist.
0 high0 material2 low
What this review found
No material or high-risk item was identified.
Expected scanner matches (2)
Gitleaks reported jwt
Expected behavior · high confidence
This is a public identifier for the extension's own backend service. It is meant to be included in client-side code and is not a secret password; access is controlled by the backend, not by hiding this value.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule jwt in this repository.
Contextual assessment: The matched value is a Supabase anon key, which is structurally a JWT and therefore triggers gitleaks' JWT rule. Supabase anon keys are designed to be embedded in client-side code and are protected by Supabase Row Level Security policies, not by secrecy. The code comment and the project's hosted-service purpose are consistent with this being an intentional, public client identifier for the extension's own backend.
The scanner flagged a token that looks like a secret, but it is a public Supabase key meant to be included in browser extensions. It is not a private password or API key, and using it this way is normal for Supabase-based apps.
Technical evidence
Scanner reason: Gitleaks matched secret-detection rule jwt in this repository.
Contextual assessment: The matched value is a Supabase anon key, which is structurally a JWT but is designed by Supabase to be embedded in client-side code. The project uses a Supabase backend endpoint, and the variable is explicitly named and commented as a public anon key. Supabase anon keys are not private credentials; access control is enforced by Row Level Security policies on the backend. No secret exposure occurs.