skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-supabase

Identify and exploit misconfigured Supabase backends to extract data and bypass access controls.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#supabase#red team#web app security#rls bypass#anon key#data enumeration
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-supabase
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-supabase
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-supabase
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-supabase

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the problem of identifying and exploiting common Supabase backend misconfigurations (such as broken Row Level Security, exposed anon keys, and open signup endpoints) that lead to unauthorized data access, cross-tenant data leakage, and critical PII exposure in web applications using Supabase as a backend service.

Core Features & Use Cases

  • Supabase Project Discovery: Locate Supabase instances via exposed URLs and anon keys in JS bundles, .env files, and source maps.
  • Schema and Data Enumeration: List accessible tables, RPC functions, and storage buckets using exposed anon keys, with error hint enumeration for schema discovery when direct listing is disabled.
  • Misconfiguration Exploitation: Test for and exploit common flaws including RLS bypass via organization_id tampering, open signup abuse, and unauthenticated storage access.
  • Use Case: A penetration tester assessing a Lovable.dev-built web app can use this Skill to quickly find exposed Supabase anon keys, dump user PII from public tables, and validate cross-tenant access vulnerabilities.

Quick Start

Use the hunt-supabase skill to scan a target web application for exposed Supabase anon keys and test for public table access and RLS bypass vulnerabilities.

Frequently Asked Questions about hunt-supabase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exposed Supabase anon keys during a web app penetration test?▼

To find exposed Supabase anon keys during web app penetration testing, scan JS bundles, .env files, and source maps for hardcoded project URLs and keys. This allows you to enumerate accessible database schemas and storage buckets using the discovered credentials.

What is a Row Level Security bypass in Supabase and how is it tested?▼

A Row Level Security bypass in Supabase occurs when misconfigured policies allow unauthorized data access. It is tested by tampering with parameters like organization_id to validate cross-tenant vulnerabilities and extract sensitive PII from tables lacking proper access controls.

Can I enumerate Supabase database tables if direct listing is disabled?▼

You can enumerate Supabase database tables even when direct listing is disabled by leveraging error hint enumeration. Using exposed anon keys, this technique discovers schemas and RPC functions through error messages returned by the backend service.

Does this Supabase security testing approach work on apps built with Lovable.dev or Bolt.new?▼

This Supabase security testing approach works effectively on apps built with rapid development tools like Lovable.dev, Bolt.new, and Cursor. These platforms frequently integrate Supabase as a backend service and often ship with misconfigured RLS or open signup endpoints.

How do I test Supabase storage buckets for unauthenticated access?▼

To test Supabase storage buckets for unauthenticated access, use exposed anon keys to attempt direct access checks against the storage API. This identifies misconfigured public buckets that allow unauthorized extraction of sensitive files and data.

What are common Supabase misconfigurations that lead to data exposure?▼

Common Supabase misconfigurations leading to data exposure include broken Row Level Security policies, exposed anon keys in client-side code, and open signup endpoints. These flaws enable cross-tenant data leakage and critical PII extraction in web applications.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
uphiagouphiago
1.1k

hunt-graphql

Identify and validate high-severity GraphQL vulnerabilities including IDOR, SSRF, and auth bypass.

Community
Advanced
marvinbissmarvinbiss

supabase-audit-rpc

Audit exposed Supabase PostgreSQL RPC functions for security vulnerabilities.

Community
Advanced
yoanbernabeuyoanbernabeu
62

supabase-audit-tables-list

Enumerate Supabase tables exposed via the PostgREST/OpenAPI schema.

Community
Basic