supabase-pentest-skills

Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.

Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.

Orchestrate a complete Supabase security audit with guided step-by-step execution and ownership confirmation.

Analyze Supabase authentication configuration for security weaknesses and misconfigurations.

List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.

Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.

Quick reference for all Supabase security audit skills with usage examples and command overview.

Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.

Attempt to read data from exposed tables to verify actual data exposure and RLS effectiveness.

Identify storage buckets that are publicly accessible and may contain sensitive data.

Test for user enumeration vulnerabilities through various authentication endpoints.

List all tables exposed via the Supabase PostgREST API to identify the attack surface.

Extract the Supabase anon/public API key from client-side code. This key is expected in client apps but important for RLS testing.

Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.

CRITICAL - Detect if the Supabase servicerole key is leaked in client-side code. This is a P0 severity issue.

CRITICAL - Detect exposed PostgreSQL database connection strings in client-side code. Direct DB access is a P0 issue.