supabase-pentest-skills

Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.

Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.

List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.

List all tables exposed via the Supabase PostgREST API to identify the attack surface.

Attempt to read data from exposed tables to verify actual data exposure and RLS effectiveness.

Analyze Supabase authentication configuration for security weaknesses and misconfigurations.

Test if user signup is open and identify potential abuse vectors in the registration process.

Test for user enumeration vulnerabilities through various authentication endpoints.

Create a test user (with explicit permission) to audit what authenticated users can access vs anonymous users. Detects IDOR, cross-user access, and privilege escalation.

Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.

Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.

List all storage buckets and their configuration to identify the storage attack surface.

Identify storage buckets that are publicly accessible and may contain sensitive data.

Attempt to list and read files from storage buckets to verify access controls.

Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.

Initialize and manage the evidence collection directory for professional security audits with documented proof of findings.

Extract the Supabase anon/public API key from client-side code. This key is expected in client apps but important for RLS testing.

CRITICAL - Detect exposed PostgreSQL database connection strings in client-side code. Direct DB access is a P0 issue.

Extract and decode Supabase-related JWTs from client-side code, cookies, and local storage patterns.

CRITICAL - Detect if the Supabase service_role key is leaked in client-side code. This is a P0 severity issue.

Extract the Supabase project URL from client-side JavaScript code, environment variables, and configuration files.

Quick reference for all Supabase security audit skills with usage examples and command overview.

Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.

Compare two security audit reports to track remediation progress and identify new vulnerabilities.