diff --git a/package-lock.json b/package-lock.json
index f85116205..63c2c05ae 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,7 @@
       "hasInstallScript": true,
       "dependencies": {
         "@next/env": "16.2.10",
-        "@supabase/ssr": "^0.12.0",
+        "@supabase/ssr": "^0.12.3",
         "@supabase/supabase-js": "^2.108.2",
         "exceljs": "^4.4.0",
         "jszip": "^3.10.1",
@@ -3286,9 +3286,9 @@
       "license": "MIT"
     },
     "node_modules/@supabase/auth-js": {
-      "version": "2.110.2",
-      "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.110.2.tgz",
-      "integrity": "sha512-Qj7a6EDP+AMMQFWqGv+qFa8r6re//dk+qQI5bA0KK+PZmnI3JPu97TDeNt6SMiQ2FkklP79hP2yDFYSnA989OA==",
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.110.7.tgz",
+      "integrity": "sha512-M5Bpl4hCv6kHcOO/xM06Dyfg1mYLHljMkp1plhzG9IRZPc3czvyMsSN1XpL5+GKisOKM3lSN59zhpcm6sMVXfA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "2.8.1"
@@ -3298,9 +3298,9 @@
       }
     },
     "node_modules/@supabase/functions-js": {
-      "version": "2.110.2",
-      "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.110.2.tgz",
-      "integrity": "sha512-ZjjqrXpxM9/rE+eAtZxiK45EWy9EBoJQ322Q5Y75LccYQNh212neHTgXP/o4MIzmH0LNXT8UzvTZtQOfOzyoeQ==",
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.110.7.tgz",
+      "integrity": "sha512-megYmexlYEoR/0qlsr4Snh9wtzAodO7MAri3NMevZrXzNvQRKlvmTcSBoKGLQEPDakgDZMqbMdf9DwoZz6qfoA==",
       "license": "MIT",
       "dependencies": {
         "tslib": "2.8.1"
@@ -3309,12 +3309,31 @@
         "node": ">=22.0.0"
       }
     },
+    "node_modules/@supabase/phoenix": {
+      "version": "0.4.5",
+      "resolved": "https://registry.npmjs.org/@supabase/phoenix/-/phoenix-0.4.5.tgz",
+      "integrity": "sha512-aAn9H9ovVyeApKy11OWOrrOGq8DV68yWeH4ud2lN9fzn4aO8Zb5GLL9m1pUg9nLqIcT+ZDfAcsZe0E/nqdv2lw==",
+      "license": "MIT"
+    },
     "node_modules/@supabase/postgrest-js": {
-      "version": "2.110.2",
-      "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.110.2.tgz",
-      "integrity": "sha512-++LBmcIMwCtgO4tISQUmo9+2xkRwHQqS8ZKMCnhXLe9P8k8YQRXuMoh/RiSzQSoev8gqet0W7yOboW0cUxnt0Q==",
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.110.7.tgz",
+      "integrity": "sha512-ban6YV0djhVaqVYezlOARKLIuOBSvLLhyQVZjA2nxPrtswhxHCl1+gI4giFgI9ATQAaMNbUZb4JXiuL5lEA/5g==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "2.8.1"
+      },
+      "engines": {
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/@supabase/realtime-js": {
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.110.7.tgz",
+      "integrity": "sha512-AMtZjyFA2gsmjuxopPNS/sRznLQHG0Ht5x+ytTPTOh3vAcOTUlVRLx7gW4/CONNnbb3PKOkE+HmM35HOSbmomQ==",
       "license": "MIT",
       "dependencies": {
+        "@supabase/phoenix": "0.4.5",
         "tslib": "2.8.1"
       },
       "engines": {
@@ -3322,21 +3341,21 @@
       }
     },
     "node_modules/@supabase/ssr": {
-      "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/@supabase/ssr/-/ssr-0.12.0.tgz",
-      "integrity": "sha512-d9XV5XzJvzzZbeAIM7fWTCUYxQJZ2Ru6ny3dJHmHGp/LIrJ+o9FpD7N9Rf/UhhWEvHXSoDe8SI32Z2ouOdMjBg==",
+      "version": "0.12.3",
+      "resolved": "https://registry.npmjs.org/@supabase/ssr/-/ssr-0.12.3.tgz",
+      "integrity": "sha512-qWXJ/dI7CiYDKyTgIPqJ4Qkh8y5edh2LdF/nkN48z47mmEVzAO2OE+YErYeQ/UemVfonn/F4kFz+lhLqoVMdpw==",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.2"
       },
       "peerDependencies": {
-        "@supabase/supabase-js": "^2.108.0"
+        "@supabase/supabase-js": "^2.110.5"
       }
     },
     "node_modules/@supabase/storage-js": {
-      "version": "2.110.2",
-      "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.110.2.tgz",
-      "integrity": "sha512-EhsRSwSnmQefKJsAxoRUZ0hvHr92ECM8DDGAKR5z0HdoJx4heI60PjHUTruVNZxKX6XeobLGDyLud020Bw1iwg==",
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.110.7.tgz",
+      "integrity": "sha512-2tcDE8cjEDy1uKxKavBpKQod1JdMV1jDXQag48TCa+kycmJOltc0yVabC0BUlhOwAl6WykXU2aOsH3ELMtZrmQ==",
       "license": "MIT",
       "dependencies": {
         "iceberg-js": "^0.8.1",
@@ -3347,35 +3366,16 @@
       }
     },
     "node_modules/@supabase/supabase-js": {
-      "version": "2.110.2",
-      "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.110.2.tgz",
-      "integrity": "sha512-r9q9w4ZQ6mOjh36aqUNFSisBF611vzpO8JphBESr2Q1SWvmGFQeI7Jq7Y+PaNMZ6Zszz+S2yTlJStCpnaMSnQg==",
+      "version": "2.110.7",
+      "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.110.7.tgz",
+      "integrity": "sha512-AnfO3A230Shy6RMO7cya3Wl1OcXnABJrzH8vP+fY7/RFjhzcchB7DjKkkTIAntlwekD+GkSFzEvt2tC+D4Fp8w==",
       "license": "MIT",
       "dependencies": {
-        "@supabase/auth-js": "2.110.2",
-        "@supabase/functions-js": "2.110.2",
-        "@supabase/postgrest-js": "2.110.2",
-        "@supabase/realtime-js": "2.110.2",
-        "@supabase/storage-js": "2.110.2"
-      },
-      "engines": {
-        "node": ">=22.0.0"
-      }
-    },
-    "node_modules/@supabase/supabase-js/node_modules/@supabase/phoenix": {
-      "version": "0.4.4",
-      "resolved": "https://registry.npmjs.org/@supabase/phoenix/-/phoenix-0.4.4.tgz",
-      "integrity": "sha512-Gt0pqoXuIqX/8dvG0OKp/wMCobXNH3klNbUPBNyOfN0YA1IswrM3HyWFMOPk1Jy+BRaIyDPcFx4jLBwHNmlyfQ==",
-      "license": "MIT"
-    },
-    "node_modules/@supabase/supabase-js/node_modules/@supabase/realtime-js": {
-      "version": "2.110.2",
-      "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.110.2.tgz",
-      "integrity": "sha512-z3jTOTPgyn6E3r6dVOOQ10He4yAMB2czjFw7xVdX3s16MHElna5rY1gVaePs0NIo6xvtMYbtmOXlFaFt/ePLpg==",
-      "license": "MIT",
-      "dependencies": {
-        "@supabase/phoenix": "0.4.4",
-        "tslib": "2.8.1"
+        "@supabase/auth-js": "2.110.7",
+        "@supabase/functions-js": "2.110.7",
+        "@supabase/postgrest-js": "2.110.7",
+        "@supabase/realtime-js": "2.110.7",
+        "@supabase/storage-js": "2.110.7"
       },
       "engines": {
         "node": ">=22.0.0"
diff --git a/package.json b/package.json
index ba06a05a4..0c5c5494b 100644
--- a/package.json
+++ b/package.json
@@ -177,7 +177,7 @@
   },
   "dependencies": {
     "@next/env": "16.2.10",
-    "@supabase/ssr": "^0.12.0",
+    "@supabase/ssr": "^0.12.3",
     "@supabase/supabase-js": "^2.108.2",
     "exceljs": "^4.4.0",
     "jszip": "^3.10.1",
diff --git a/scripts/check-client-bundle-secrets.mjs b/scripts/check-client-bundle-secrets.mjs
index 9319a103f..3e36b1503 100644
--- a/scripts/check-client-bundle-secrets.mjs
+++ b/scripts/check-client-bundle-secrets.mjs
@@ -11,7 +11,11 @@ const forbiddenMarkers = [
   "OPENAI_ORG_ID",
   "OPENAI_PROJECT_ID",
   "RAG_QUERY_HASH_SECRET",
-  "sb_secret_",
+  // Match an actual secret *value* (prefix + a long token), not the bare "sb_secret_"
+  // prefix string. @supabase/supabase-js's own browser client code legitimately ships
+  // that literal prefix (isNewApiKey()/checkApiKeyFormat() in its fetch helpers, used to
+  // detect new-format Supabase API keys) — that string alone is not a leaked secret.
+  /\bsb_secret_[A-Za-z0-9_-]{20,}\b/,
   "sk-proj-",
   "sk-svcacct-",
 ];
@@ -47,9 +51,11 @@ const offenders = new Map();
 for (const file of [...textFiles(publicRoot), ...textFiles(clientBuildRoot)]) {
   const content = readFileSync(file, "utf8");
   for (const marker of forbiddenMarkers) {
-    if (content.includes(marker)) {
+    const matchedText =
+      marker instanceof RegExp ? content.match(marker)?.[0] : content.includes(marker) ? marker : null;
+    if (matchedText) {
       const relativePath = relative(projectRoot, file).replaceAll("\\", "/");
-      offenders.set(`${relativePath}\0${marker}`, { marker, relativePath });
+      offenders.set(`${relativePath}\0${matchedText}`, { marker: matchedText, relativePath });
     }
   }
 }