| name | plan-security-audit |
| description | OWASP Top 10 security audit with Supabase-first methodology — RLS pass, bundle/secret scan, auth-path tracing, dependency CVEs. Plan only, no patches or destructive testing. Never paste secret values — location + rotation flag only. Research-backed: tables without RLS and service_role in client bundle as top critical classes. Use when asked to "security audit plan", "OWASP audit", "RLS audit", "Supabase security review", "hardening plan", "secrets scan plan", "plan security fixes", or "security burndown".
|
| license | MIT |
Security Audit + Hardening Plan
Role: Senior application security engineer.
Task: Exhaustive vulnerability audit (frontend, backend, auth, Supabase, deps, secrets),
mapped to OWASP Top 10, then remediation plan. Audit & plan only — no code changes, no
destructive testing.
This skill vs neighbors
| Skill | Does |
|---|
| plan-security-audit (this) | Plan with OWASP + Supabase-first burndown |
audit-security | Static security review (may fix) |
test-red-team | Adversarial runtime testing |
audit-db-schema | Schema health including RLS review |
Loop: see docs/PLAN-LOOPS.md — after plan-test-coverage, parallel with plan-perf-audit, before plan-docs-sync
⛔ Preservation Contract
Read references/preservation-contract.md. Acknowledge in output #1.
Safety guardrails:
- No destructive/live exploit testing
- Never paste found secret values — location + type, flag for rotation
References
| File | Contents |
|---|
references/owasp-supabase-scope.md | OWASP map, RLS-first methodology, scans |
references/output-templates.md | Burndown, phased hardening, secrets list |
Phase flow
1. Stack fingerprint
2. RLS-first pass (Supabase MCP if available)
3. Bundle/secret scan (no value echo)
4. Auth-path trace
5. Dependency CVE scan
6. OWASP remainder (injection, headers, misconfig)
7. Burndown + phased hardening plan
8. Guardrails + research citations
Sentry MCP: security-related production errors. Firecrawl: current OWASP + Supabase patterns.
Phase 2 — RLS-first (Supabase)
Enumerate every public table:
- RLS enabled?
- Policies scope rows correctly?
WITH CHECK on writes?- Realtime respects SELECT policies?
#1 critical class: table without RLS + anon key in client = full data exposure.
Detail: references/owasp-supabase-scope.md
Phase 3 — Bundle/secret scan
Inspect client bundle + source for:
service_role key (Critical — full RLS bypass)- Hardcoded API keys, DSNs
.env committed / not gitignored- Secrets in git history → rotate (history is forever)
Report: file:line + type only — never the value.
Phase 4–6 — Auth, deps, OWASP
- Every protected route/endpoint → server-side enforcement?
npm audit, lockfile versions vs CVE databases- XSS, SQLi, SSRF, headers/CSP, rate limits
Map each finding to OWASP category.
Burndown + hardening plan
Template: references/output-templates.md
Phases: Critical → High → Med/Low. Each remediation + "what must keep working".
Re-scan proposed after fixes (second pass).
Required output (in order)
- Preservation-contract acknowledgment
- Stack fingerprint + scope
- Per-area finding inventory
- Burndown table (OWASP + evidence + severity)
- Hardening + enhancement plan, phased
- Guardrails/tooling (SCA CI, secrets manager, RLS tests)
- Research notes + citations
- Open questions /
[NEEDS VERIFICATION] + secrets-to-rotate (locations only)
Rules
- Plan only — no patches, no live/destructive testing.
- Every finding cites real evidence. Unconfirmed →
[NEEDS VERIFICATION].
- Never paste secret values.
- Never fabricate CVEs or exploits.
- Separate confirmed vulnerability vs hardening recommendation.
