supabase-security-audit

Audits the overall API attack surface of a Supabase project including exposed tables, data volume, and role grants. Use when user says "how much is exposed", "audit API surface", "what can anon access", or "too many tables visible". Generates read-only SQL for the Supabase SQL Editor.

Audits Supabase authentication configuration including user status, MFA adoption, unconfirmed accounts, and auth hook security. Use when user says "check auth security", "MFA adoption", "unconfirmed users", "audit authentication", or "JWT security". Generates read-only SQL for the Supabase SQL Editor.

Reviews existing RLS policies on Supabase tables for gaps and misconfigurations. Use when user says "review my policies", "check RLS policies", "find permissive policies", or "why can anon write to my table". Generates read-only SQL for the Supabase SQL Editor.

Audits Supabase Realtime subscriptions for data leaks including tables without RLS broadcasting changes. Use when user says "check Realtime security", "who can see my Realtime data", "audit subscriptions", or "Realtime leaking data". Generates read-only SQL for the Supabase SQL Editor.

Finds Supabase tables missing Row Level Security (RLS). Use when user says "check RLS", "are my tables secure", "find unprotected tables", or "audit table security". Generates read-only SQL queries for the Supabase SQL Editor.

Audits Supabase RPC functions for security risks including anon access, SECURITY DEFINER issues, and search_path vulnerabilities. Use when user says "check my functions", "which functions can anon call", "audit RPC security", or "SECURITY DEFINER risk". Generates read-only SQL for the Supabase SQL Editor.

Finds exposed sensitive columns like passwords, tokens, API keys, SSNs, and credit card numbers in Supabase tables. Use when user says "check for PII", "sensitive data exposed", "are passwords visible", or "audit column security". Generates read-only SQL for the Supabase SQL Editor.

Audits Supabase storage buckets for public access, missing policies, and upload restrictions. Use when user says "check storage security", "are my buckets public", "audit file uploads", or "storage bucket exposed". Generates read-only SQL for the Supabase SQL Editor.

Emergency security assessment for a potentially compromised Supabase project. Use ONLY when user says "I think I've been hacked", "breach assessment", "credentials leaked", or "emergency security check". Provides read-only assessment queries and a manual response plan. Do NOT use for routine audits.

Runs a comprehensive Supabase security audit covering RLS, policies, sensitive columns, storage, functions, API exposure, auth, and Realtime in one script. Use when user says "full security audit", "check everything", "security posture", or "complete Supabase audit". Generates a single read-only SQL script for the Supabase SQL Editor.