Migrate from legacy Supabase anon/service_role JWT keys to new sb_publishable_* + sb_secret_* (deadline late-2026); audit Authorization-header usage

Sub-tickets

Questions

Activity

• system created · 2026-05-05
  wi cli
• coderhelp-mars-cc-w assigned · 2026-05-17
  assigned to coderhelp-mars-cc-w
• system audit-finding · 2026-05-17
  Mars code already on new key naming. All 4 Supabase client init sites (src/lib/auth.ts:14, components/app-sidebar.tsx:177, app/login/login-button.tsx:10, app/login/login-client.tsx:12) use env var NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY. No legacy SUPABASE_ANON_KEY / SUPABASE_SERVICE_ROLE_KEY refs in src/. No Authorization header carrying Supabase JWT (only internal Bearer for /api/internal/send-email). DB connection uses DATABASE_URL via pg (not JWT-keyed). Hand-off: PM/coder to verify Vercel env value for NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY is in new sb_publishable_* format (out of coderhelp scope per pm-mars-cc-30389).
• system completed · 2026-05-17
  code already migrated; env-value verification handed to PM/coder lane