Supabase Admin Client Bypasses RLS for Backend

1. Using admin key on client side (security issue)
2. Service role key exposed in version control
3. Not understanding difference between anon and admin
4. Not needed - should use RLS policies instead
5. Admin operations without authentication check

Use admin client only in backend/Edge Functions:

// Edge Function - safe to use admin key
const adminClient = createClient(URL, SERVICE_KEY);

const { data } = await adminClient
  .from('users')
  .update({ role: 'admin' })
  .eq('id', userId);

// Never expose SERVICE_KEY to browser!

Store SERVICE_KEY in environment, never commit to Git.