https://shipreadyai.dev/glossary/anon-key

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Anon key

The public browser key. Safe to publish, useless without rules behind it.

The anon key is the public key your app ships to the browser so it can talk to your backend. It is meant to be visible. Seeing it in your bundle is not a finding.

The mistake is assuming it protects anything. It identifies the project, not the person. Everything it can reach is decided by the row rules behind it. If a table has no rules, the anon key reads that table, and so can anyone who opens your app and copies the key.

A check from outside can take the published key and ask your tables whether they answer. When they do, that is finding O8, with the table name as evidence. Whether the rules that should be there are correct is a separate question that no URL can settle.