hunt-supabase

What problem does it solve?

This Skill solves the problem of identifying and exploiting common Supabase backend misconfigurations (such as broken Row Level Security, exposed anon keys, and open signup endpoints) that lead to unauthorized data access, cross-tenant data leakage, and critical PII exposure in web applications using Supabase as a backend service.

Core Features & Use Cases

• Supabase Project Discovery: Locate Supabase instances via exposed URLs and anon keys in JS bundles, .env files, and source maps.
• Schema and Data Enumeration: List accessible tables, RPC functions, and storage buckets using exposed anon keys, with error hint enumeration for schema discovery when direct listing is disabled.
• Misconfiguration Exploitation: Test for and exploit common flaws including RLS bypass via organization_id tampering, open signup abuse, and unauthenticated storage access.
• Use Case: A penetration tester assessing a Lovable.dev-built web app can use this Skill to quickly find exposed Supabase anon keys, dump user PII from public tables, and validate cross-tenant access vulnerabilities.

Quick Start

Use the hunt-supabase skill to scan a target web application for exposed Supabase anon keys and test for public table access and RLS bypass vulnerabilities.