hunt-supabase

To test for Supabase RLS bypasses and insecure API endpoints, you can automate reconnaissance to detect exposed project URLs and anon keys, then assess unauthorized data access and privilege escalation vectors using REST API requests.

Supabase backend data is often exposed by Row Level Security (RLS) bypasses, insecure RPC functions, and public storage bucket access, which allow unauthorized data retrieval and cross-tenant privilege escalation.

You can find exposed Supabase project references and anon keys by scanning a target domain's JS bundles, source maps, and configuration files during the automated reconnaissance phase.

Yes, you need curl and python3 installed to execute REST API requests and parse JSON responses during the reconnaissance and exploitation phases of Supabase misconfiguration scanning.

Yes, you can verify cross-tenant data access by taking an exposed Supabase anon key found in frontend code and testing it against database tables to check for unauthorized access and privilege escalation.

Automated Supabase pentest reconnaissance targets specific misconfigurations like RLS bypasses and insecure API endpoints, but requires precise curl and python3 environments to parse JSON responses and cannot detect complex logic flaws.