A Hasura admin secret in browser code bypasses everything

Hasura enforces access through per-role permissions on each table. The x-hasura-admin-secret header exists to bypass all of them, for administrative work.

Sent from browser code, it hands every visitor full read and write access to your entire database.

Remove the header from all client code and rotate the secret — treat the old one as public knowledge.

Configure a JWT secret in Hasura, have your auth provider issue tokens, and let the browser send only the signed-in user's own token. Then define permissions for the user role, with a row filter such as {"user_id":{"_eq":"X-Hasura-User-Id"}}.

Search your built bundle for "admin-secret" — it should return nothing. Then query the endpoint with no headers: you should get only what the anonymous role is genuinely allowed to see.

Rotating the secret but leaving the old one in git history or in a public environment variable. Check both, and remember that a NEXT_PUBLIC_ or VITE_ prefix makes any variable public.